net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include "core.h"
  23 #include "nl80211.h"
  24 #include "reg.h"
  25
  26 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type);
  27 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  28                                    struct genl_info *info,
  29                                    struct cfg80211_crypto_settings *settings,
  30                                    int cipher_limit);
  31
  32 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  33                             struct genl_info *info);
  34 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  35                               struct genl_info *info);
  36
  37 /* the netlink family */
  38 static struct genl_family nl80211_fam = {
  39         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  40         .name = "nl80211",      /* have users key off the name instead */
  41         .hdrsize = 0,           /* no private header */
  42         .version = 1,           /* no particular meaning now */
  43         .maxattr = NL80211_ATTR_MAX,
  44         .netnsok = true,
  45         .pre_doit = nl80211_pre_doit,
  46         .post_doit = nl80211_post_doit,
  47 };
  48
  49 /* internal helper: get rdev and dev */
  50 static int get_rdev_dev_by_ifindex(struct net *netns, struct nlattr **attrs,
  51                                    struct cfg80211_registered_device **rdev,
  52                                    struct net_device **dev)
  53 {
  54         int ifindex;
  55
  56         if (!attrs[NL80211_ATTR_IFINDEX])
  57                 return -EINVAL;
  58
  59         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  60         *dev = dev_get_by_index(netns, ifindex);
  61         if (!*dev)
  62                 return -ENODEV;
  63
  64         *rdev = cfg80211_get_dev_from_ifindex(netns, ifindex);
  65         if (IS_ERR(*rdev)) {
  66                 dev_put(*dev);
  67                 return PTR_ERR(*rdev);
  68         }
  69
  70         return 0;
  71 }
  72
  73 /* policy for the attributes */
  74 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
  75         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  76         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  77                                       .len = 20-1 },
  78         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  79         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  80         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  81         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  82         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  83         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  84         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  85         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
  86
  87         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  88         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  89         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  90
  91         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
  92         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
  93
  94         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  95         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  96                                     .len = WLAN_MAX_KEY_LEN },
  97         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  98         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  99         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 100         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 101         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 102
 103         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 104         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 105         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 106                                        .len = IEEE80211_MAX_DATA_LEN },
 107         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 108                                        .len = IEEE80211_MAX_DATA_LEN },
 109         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 110         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 111         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 112         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 113                                                .len = NL80211_MAX_SUPP_RATES },
 114         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 115         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 116         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 117         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 118                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 119         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 120
 121         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 122         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 123
 124         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 125         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 126         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 127         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 128                                            .len = NL80211_MAX_SUPP_RATES },
 129         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 130
 131         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 132         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 133
 134         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 135
 136         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 137         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 138                               .len = IEEE80211_MAX_DATA_LEN },
 139         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 140         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 141
 142         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 143                                 .len = IEEE80211_MAX_SSID_LEN },
 144         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 145         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 146         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 147         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 148         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 149         [NL80211_ATTR_STA_FLAGS2] = {
 150                 .len = sizeof(struct nl80211_sta_flag_update),
 151         },
 152         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 153         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 154         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 155         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 156         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 157         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 158         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 159         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 160         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 161                                  .len = WLAN_PMKID_LEN },
 162         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 163         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 164         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 165         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 166                                  .len = IEEE80211_MAX_DATA_LEN },
 167         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 168         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 169         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 170         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 171         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 172         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 173         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 174         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 175         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 176         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 177         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 178         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 179         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 180         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 181         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 182         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 183         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 184         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 185         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 186         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 187                                          .len = IEEE80211_MAX_DATA_LEN },
 188         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 189                                          .len = IEEE80211_MAX_DATA_LEN },
 190         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 191         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 192         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 193         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 194         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 195         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 196         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 197         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 198         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 199         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 200                                       .len = IEEE80211_MAX_DATA_LEN },
 201         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 202         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 203         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 204                 .len = NL80211_HT_CAPABILITY_LEN
 205         },
 206         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 207 };
 208
 209 /* policy for the key attributes */
 210 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 211         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 212         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 213         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 214         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 215         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 216         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 217         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 218         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 219 };
 220
 221 /* policy for the key default flags */
 222 static const struct nla_policy
 223 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 224         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 225         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 226 };
 227
 228 /* policy for WoWLAN attributes */
 229 static const struct nla_policy
 230 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 231         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 232         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 233         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 234         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 235         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 236         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 237         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 238         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 239 };
 240
 241 /* policy for GTK rekey offload attributes */
 242 static const struct nla_policy
 243 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 244         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 245         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 246         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 247 };
 248
 249 static const struct nla_policy
 250 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 251         [NL80211_ATTR_SCHED_SCAN_MATCH_SSID] = { .type = NLA_BINARY,
 252                                                  .len = IEEE80211_MAX_SSID_LEN },
 253 };
 254
 255 /* ifidx get helper */
 256 static int nl80211_get_ifidx(struct netlink_callback *cb)
 257 {
 258         int res;
 259
 260         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 261                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 262                           nl80211_policy);
 263         if (res)
 264                 return res;
 265
 266         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 267                 return -EINVAL;
 268
 269         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 270         if (!res)
 271                 return -EINVAL;
 272         return res;
 273 }
 274
 275 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 276                                        struct netlink_callback *cb,
 277                                        struct cfg80211_registered_device **rdev,
 278                                        struct net_device **dev)
 279 {
 280         int ifidx = cb->args[0];
 281         int err;
 282
 283         if (!ifidx)
 284                 ifidx = nl80211_get_ifidx(cb);
 285         if (ifidx < 0)
 286                 return ifidx;
 287
 288         cb->args[0] = ifidx;
 289
 290         rtnl_lock();
 291
 292         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 293         if (!*dev) {
 294                 err = -ENODEV;
 295                 goto out_rtnl;
 296         }
 297
 298         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 299         if (IS_ERR(*rdev)) {
 300                 err = PTR_ERR(*rdev);
 301                 goto out_rtnl;
 302         }
 303
 304         return 0;
 305  out_rtnl:
 306         rtnl_unlock();
 307         return err;
 308 }
 309
 310 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 311 {
 312         cfg80211_unlock_rdev(rdev);
 313         rtnl_unlock();
 314 }
 315
 316 /* IE validation */
 317 static bool is_valid_ie_attr(const struct nlattr *attr)
 318 {
 319         const u8 *pos;
 320         int len;
 321
 322         if (!attr)
 323                 return true;
 324
 325         pos = nla_data(attr);
 326         len = nla_len(attr);
 327
 328         while (len) {
 329                 u8 elemlen;
 330
 331                 if (len < 2)
 332                         return false;
 333                 len -= 2;
 334
 335                 elemlen = pos[1];
 336                 if (elemlen > len)
 337                         return false;
 338
 339                 len -= elemlen;
 340                 pos += 2 + elemlen;
 341         }
 342
 343         return true;
 344 }
 345
 346 /* message building helper */
 347 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 348                                    int flags, u8 cmd)
 349 {
 350         /* since there is no private header just add the generic one */
 351         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 352 }
 353
 354 static int nl80211_msg_put_channel(struct sk_buff *msg,
 355                                    struct ieee80211_channel *chan)
 356 {
 357         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 358                     chan->center_freq);
 359
 360         if (chan->flags & IEEE80211_CHAN_DISABLED)
 361                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 362         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 363                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 364         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 365                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 366         if (chan->flags & IEEE80211_CHAN_RADAR)
 367                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 368
 369         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 370                     DBM_TO_MBM(chan->max_power));
 371
 372         return 0;
 373
 374  nla_put_failure:
 375         return -ENOBUFS;
 376 }
 377
 378 /* netlink command implementations */
 379
 380 struct key_parse {
 381         struct key_params p;
 382         int idx;
 383         int type;
 384         bool def, defmgmt;
 385         bool def_uni, def_multi;
 386 };
 387
 388 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 389 {
 390         struct nlattr *tb[NL80211_KEY_MAX + 1];
 391         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 392                                    nl80211_key_policy);
 393         if (err)
 394                 return err;
 395
 396         k->def = !!tb[NL80211_KEY_DEFAULT];
 397         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 398
 399         if (k->def) {
 400                 k->def_uni = true;
 401                 k->def_multi = true;
 402         }
 403         if (k->defmgmt)
 404                 k->def_multi = true;
 405
 406         if (tb[NL80211_KEY_IDX])
 407                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 408
 409         if (tb[NL80211_KEY_DATA]) {
 410                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 411                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 412         }
 413
 414         if (tb[NL80211_KEY_SEQ]) {
 415                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 416                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 417         }
 418
 419         if (tb[NL80211_KEY_CIPHER])
 420                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 421
 422         if (tb[NL80211_KEY_TYPE]) {
 423                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 424                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 425                         return -EINVAL;
 426         }
 427
 428         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 429                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 430                 int err = nla_parse_nested(kdt,
 431                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 432                                            tb[NL80211_KEY_DEFAULT_TYPES],
 433                                            nl80211_key_default_policy);
 434                 if (err)
 435                         return err;
 436
 437                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 438                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 439         }
 440
 441         return 0;
 442 }
 443
 444 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 445 {
 446         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 447                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 448                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 449         }
 450
 451         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 452                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 453                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 454         }
 455
 456         if (info->attrs[NL80211_ATTR_KEY_IDX])
 457                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 458
 459         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 460                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 461
 462         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 463         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 464
 465         if (k->def) {
 466                 k->def_uni = true;
 467                 k->def_multi = true;
 468         }
 469         if (k->defmgmt)
 470                 k->def_multi = true;
 471
 472         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 473                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 474                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 475                         return -EINVAL;
 476         }
 477
 478         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 479                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 480                 int err = nla_parse_nested(
 481                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 482                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 483                                 nl80211_key_default_policy);
 484                 if (err)
 485                         return err;
 486
 487                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 488                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 489         }
 490
 491         return 0;
 492 }
 493
 494 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 495 {
 496         int err;
 497
 498         memset(k, 0, sizeof(*k));
 499         k->idx = -1;
 500         k->type = -1;
 501
 502         if (info->attrs[NL80211_ATTR_KEY])
 503                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 504         else
 505                 err = nl80211_parse_key_old(info, k);
 506
 507         if (err)
 508                 return err;
 509
 510         if (k->def && k->defmgmt)
 511                 return -EINVAL;
 512
 513         if (k->defmgmt) {
 514                 if (k->def_uni || !k->def_multi)
 515                         return -EINVAL;
 516         }
 517
 518         if (k->idx != -1) {
 519                 if (k->defmgmt) {
 520                         if (k->idx < 4 || k->idx > 5)
 521                                 return -EINVAL;
 522                 } else if (k->def) {
 523                         if (k->idx < 0 || k->idx > 3)
 524                                 return -EINVAL;
 525                 } else {
 526                         if (k->idx < 0 || k->idx > 5)
 527                                 return -EINVAL;
 528                 }
 529         }
 530
 531         return 0;
 532 }
 533
 534 static struct cfg80211_cached_keys *
 535 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 536                        struct nlattr *keys)
 537 {
 538         struct key_parse parse;
 539         struct nlattr *key;
 540         struct cfg80211_cached_keys *result;
 541         int rem, err, def = 0;
 542
 543         result = kzalloc(sizeof(*result), GFP_KERNEL);
 544         if (!result)
 545                 return ERR_PTR(-ENOMEM);
 546
 547         result->def = -1;
 548         result->defmgmt = -1;
 549
 550         nla_for_each_nested(key, keys, rem) {
 551                 memset(&parse, 0, sizeof(parse));
 552                 parse.idx = -1;
 553
 554                 err = nl80211_parse_key_new(key, &parse);
 555                 if (err)
 556                         goto error;
 557                 err = -EINVAL;
 558                 if (!parse.p.key)
 559                         goto error;
 560                 if (parse.idx < 0 || parse.idx > 4)
 561                         goto error;
 562                 if (parse.def) {
 563                         if (def)
 564                                 goto error;
 565                         def = 1;
 566                         result->def = parse.idx;
 567                         if (!parse.def_uni || !parse.def_multi)
 568                                 goto error;
 569                 } else if (parse.defmgmt)
 570                         goto error;
 571                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 572                                                      parse.idx, false, NULL);
 573                 if (err)
 574                         goto error;
 575                 result->params[parse.idx].cipher = parse.p.cipher;
 576                 result->params[parse.idx].key_len = parse.p.key_len;
 577                 result->params[parse.idx].key = result->data[parse.idx];
 578                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 579         }
 580
 581         return result;
 582  error:
 583         kfree(result);
 584         return ERR_PTR(err);
 585 }
 586
 587 static int nl80211_key_allowed(struct wireless_dev *wdev)
 588 {
 589         ASSERT_WDEV_LOCK(wdev);
 590
 591         switch (wdev->iftype) {
 592         case NL80211_IFTYPE_AP:
 593         case NL80211_IFTYPE_AP_VLAN:
 594         case NL80211_IFTYPE_P2P_GO:
 595         case NL80211_IFTYPE_MESH_POINT:
 596                 break;
 597         case NL80211_IFTYPE_ADHOC:
 598                 if (!wdev->current_bss)
 599                         return -ENOLINK;
 600                 break;
 601         case NL80211_IFTYPE_STATION:
 602         case NL80211_IFTYPE_P2P_CLIENT:
 603                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 604                         return -ENOLINK;
 605                 break;
 606         default:
 607                 return -EINVAL;
 608         }
 609
 610         return 0;
 611 }
 612
 613 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 614 {
 615         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 616         int i;
 617
 618         if (!nl_modes)
 619                 goto nla_put_failure;
 620
 621         i = 0;
 622         while (ifmodes) {
 623                 if (ifmodes & 1)
 624                         NLA_PUT_FLAG(msg, i);
 625                 ifmodes >>= 1;
 626                 i++;
 627         }
 628
 629         nla_nest_end(msg, nl_modes);
 630         return 0;
 631
 632 nla_put_failure:
 633         return -ENOBUFS;
 634 }
 635
 636 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 637                                           struct sk_buff *msg)
 638 {
 639         struct nlattr *nl_combis;
 640         int i, j;
 641
 642         nl_combis = nla_nest_start(msg,
 643                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 644         if (!nl_combis)
 645                 goto nla_put_failure;
 646
 647         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 648                 const struct ieee80211_iface_combination *c;
 649                 struct nlattr *nl_combi, *nl_limits;
 650
 651                 c = &wiphy->iface_combinations[i];
 652
 653                 nl_combi = nla_nest_start(msg, i + 1);
 654                 if (!nl_combi)
 655                         goto nla_put_failure;
 656
 657                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 658                 if (!nl_limits)
 659                         goto nla_put_failure;
 660
 661                 for (j = 0; j < c->n_limits; j++) {
 662                         struct nlattr *nl_limit;
 663
 664                         nl_limit = nla_nest_start(msg, j + 1);
 665                         if (!nl_limit)
 666                                 goto nla_put_failure;
 667                         NLA_PUT_U32(msg, NL80211_IFACE_LIMIT_MAX,
 668                                     c->limits[j].max);
 669                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 670                                                 c->limits[j].types))
 671                                 goto nla_put_failure;
 672                         nla_nest_end(msg, nl_limit);
 673                 }
 674
 675                 nla_nest_end(msg, nl_limits);
 676
 677                 if (c->beacon_int_infra_match)
 678                         NLA_PUT_FLAG(msg,
 679                                 NL80211_IFACE_COMB_STA_AP_BI_MATCH);
 680                 NLA_PUT_U32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 681                             c->num_different_channels);
 682                 NLA_PUT_U32(msg, NL80211_IFACE_COMB_MAXNUM,
 683                             c->max_interfaces);
 684
 685                 nla_nest_end(msg, nl_combi);
 686         }
 687
 688         nla_nest_end(msg, nl_combis);
 689
 690         return 0;
 691 nla_put_failure:
 692         return -ENOBUFS;
 693 }
 694
 695 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 696                               struct cfg80211_registered_device *dev)
 697 {
 698         void *hdr;
 699         struct nlattr *nl_bands, *nl_band;
 700         struct nlattr *nl_freqs, *nl_freq;
 701         struct nlattr *nl_rates, *nl_rate;
 702         struct nlattr *nl_cmds;
 703         enum ieee80211_band band;
 704         struct ieee80211_channel *chan;
 705         struct ieee80211_rate *rate;
 706         int i;
 707         const struct ieee80211_txrx_stypes *mgmt_stypes =
 708                                 dev->wiphy.mgmt_stypes;
 709
 710         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 711         if (!hdr)
 712                 return -1;
 713
 714         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 715         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 716
 717         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 718                     cfg80211_rdev_list_generation);
 719
 720         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 721                    dev->wiphy.retry_short);
 722         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 723                    dev->wiphy.retry_long);
 724         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 725                     dev->wiphy.frag_threshold);
 726         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 727                     dev->wiphy.rts_threshold);
 728         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 729                     dev->wiphy.coverage_class);
 730         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 731                    dev->wiphy.max_scan_ssids);
 732         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
 733                    dev->wiphy.max_sched_scan_ssids);
 734         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 735                     dev->wiphy.max_scan_ie_len);
 736         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
 737                     dev->wiphy.max_sched_scan_ie_len);
 738         NLA_PUT_U8(msg, NL80211_ATTR_MAX_MATCH_SETS,
 739                    dev->wiphy.max_match_sets);
 740
 741         if (dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)
 742                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_IBSS_RSN);
 743         if (dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH)
 744                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_MESH_AUTH);
 745         if (dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD)
 746                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_AP_UAPSD);
 747         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)
 748                 NLA_PUT_FLAG(msg, NL80211_ATTR_ROAM_SUPPORT);
 749         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS)
 750                 NLA_PUT_FLAG(msg, NL80211_ATTR_TDLS_SUPPORT);
 751         if (dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP)
 752                 NLA_PUT_FLAG(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP);
 753
 754         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 755                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 756                 dev->wiphy.cipher_suites);
 757
 758         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 759                    dev->wiphy.max_num_pmkids);
 760
 761         if (dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL)
 762                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE);
 763
 764         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
 765                     dev->wiphy.available_antennas_tx);
 766         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
 767                     dev->wiphy.available_antennas_rx);
 768
 769         if (dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD)
 770                 NLA_PUT_U32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
 771                             dev->wiphy.probe_resp_offload);
 772
 773         if ((dev->wiphy.available_antennas_tx ||
 774              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
 775                 u32 tx_ant = 0, rx_ant = 0;
 776                 int res;
 777                 res = dev->ops->get_antenna(&dev->wiphy, &tx_ant, &rx_ant);
 778                 if (!res) {
 779                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX, tx_ant);
 780                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX, rx_ant);
 781                 }
 782         }
 783
 784         if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
 785                                 dev->wiphy.interface_modes))
 786                 goto nla_put_failure;
 787
 788         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 789         if (!nl_bands)
 790                 goto nla_put_failure;
 791
 792         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 793                 if (!dev->wiphy.bands[band])
 794                         continue;
 795
 796                 nl_band = nla_nest_start(msg, band);
 797                 if (!nl_band)
 798                         goto nla_put_failure;
 799
 800                 /* add HT info */
 801                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 802                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 803                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 804                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 805                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 806                                 dev->wiphy.bands[band]->ht_cap.cap);
 807                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 808                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 809                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 810                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 811                 }
 812
 813                 /* add frequencies */
 814                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 815                 if (!nl_freqs)
 816                         goto nla_put_failure;
 817
 818                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 819                         nl_freq = nla_nest_start(msg, i);
 820                         if (!nl_freq)
 821                                 goto nla_put_failure;
 822
 823                         chan = &dev->wiphy.bands[band]->channels[i];
 824
 825                         if (nl80211_msg_put_channel(msg, chan))
 826                                 goto nla_put_failure;
 827
 828                         nla_nest_end(msg, nl_freq);
 829                 }
 830
 831                 nla_nest_end(msg, nl_freqs);
 832
 833                 /* add bitrates */
 834                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 835                 if (!nl_rates)
 836                         goto nla_put_failure;
 837
 838                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 839                         nl_rate = nla_nest_start(msg, i);
 840                         if (!nl_rate)
 841                                 goto nla_put_failure;
 842
 843                         rate = &dev->wiphy.bands[band]->bitrates[i];
 844                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 845                                     rate->bitrate);
 846                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 847                                 NLA_PUT_FLAG(msg,
 848                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 849
 850                         nla_nest_end(msg, nl_rate);
 851                 }
 852
 853                 nla_nest_end(msg, nl_rates);
 854
 855                 nla_nest_end(msg, nl_band);
 856         }
 857         nla_nest_end(msg, nl_bands);
 858
 859         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 860         if (!nl_cmds)
 861                 goto nla_put_failure;
 862
 863         i = 0;
 864 #define CMD(op, n)                                              \
 865          do {                                                   \
 866                 if (dev->ops->op) {                             \
 867                         i++;                                    \
 868                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 869                 }                                               \
 870         } while (0)
 871
 872         CMD(add_virtual_intf, NEW_INTERFACE);
 873         CMD(change_virtual_intf, SET_INTERFACE);
 874         CMD(add_key, NEW_KEY);
 875         CMD(add_beacon, NEW_BEACON);
 876         CMD(add_station, NEW_STATION);
 877         CMD(add_mpath, NEW_MPATH);
 878         CMD(update_mesh_config, SET_MESH_CONFIG);
 879         CMD(change_bss, SET_BSS);
 880         CMD(auth, AUTHENTICATE);
 881         CMD(assoc, ASSOCIATE);
 882         CMD(deauth, DEAUTHENTICATE);
 883         CMD(disassoc, DISASSOCIATE);
 884         CMD(join_ibss, JOIN_IBSS);
 885         CMD(join_mesh, JOIN_MESH);
 886         CMD(set_pmksa, SET_PMKSA);
 887         CMD(del_pmksa, DEL_PMKSA);
 888         CMD(flush_pmksa, FLUSH_PMKSA);
 889         if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
 890                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
 891         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
 892         CMD(mgmt_tx, FRAME);
 893         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
 894         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
 895                 i++;
 896                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 897         }
 898         CMD(set_channel, SET_CHANNEL);
 899         CMD(set_wds_peer, SET_WDS_PEER);
 900         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
 901                 CMD(tdls_mgmt, TDLS_MGMT);
 902                 CMD(tdls_oper, TDLS_OPER);
 903         }
 904         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
 905                 CMD(sched_scan_start, START_SCHED_SCAN);
 906         CMD(probe_client, PROBE_CLIENT);
 907         CMD(set_noack_map, SET_NOACK_MAP);
 908         if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
 909                 i++;
 910                 NLA_PUT_U32(msg, i, NL80211_CMD_REGISTER_BEACONS);
 911         }
 912
 913 #ifdef CONFIG_NL80211_TESTMODE
 914         CMD(testmode_cmd, TESTMODE);
 915 #endif
 916
 917 #undef CMD
 918
 919         if (dev->ops->connect || dev->ops->auth) {
 920                 i++;
 921                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 922         }
 923
 924         if (dev->ops->disconnect || dev->ops->deauth) {
 925                 i++;
 926                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 927         }
 928
 929         nla_nest_end(msg, nl_cmds);
 930
 931         if (dev->ops->remain_on_channel &&
 932             dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
 933                 NLA_PUT_U32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
 934                             dev->wiphy.max_remain_on_channel_duration);
 935
 936         if (dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)
 937                 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
 938
 939         if (mgmt_stypes) {
 940                 u16 stypes;
 941                 struct nlattr *nl_ftypes, *nl_ifs;
 942                 enum nl80211_iftype ift;
 943
 944                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
 945                 if (!nl_ifs)
 946                         goto nla_put_failure;
 947
 948                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 949                         nl_ftypes = nla_nest_start(msg, ift);
 950                         if (!nl_ftypes)
 951                                 goto nla_put_failure;
 952                         i = 0;
 953                         stypes = mgmt_stypes[ift].tx;
 954                         while (stypes) {
 955                                 if (stypes & 1)
 956                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 957                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
 958                                 stypes >>= 1;
 959                                 i++;
 960                         }
 961                         nla_nest_end(msg, nl_ftypes);
 962                 }
 963
 964                 nla_nest_end(msg, nl_ifs);
 965
 966                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
 967                 if (!nl_ifs)
 968                         goto nla_put_failure;
 969
 970                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 971                         nl_ftypes = nla_nest_start(msg, ift);
 972                         if (!nl_ftypes)
 973                                 goto nla_put_failure;
 974                         i = 0;
 975                         stypes = mgmt_stypes[ift].rx;
 976                         while (stypes) {
 977                                 if (stypes & 1)
 978                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 979                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
 980                                 stypes >>= 1;
 981                                 i++;
 982                         }
 983                         nla_nest_end(msg, nl_ftypes);
 984                 }
 985                 nla_nest_end(msg, nl_ifs);
 986         }
 987
 988         if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
 989                 struct nlattr *nl_wowlan;
 990
 991                 nl_wowlan = nla_nest_start(msg,
 992                                 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
 993                 if (!nl_wowlan)
 994                         goto nla_put_failure;
 995
 996                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY)
 997                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
 998                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT)
 999                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
1000                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT)
1001                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
1002                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY)
1003                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED);
1004                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)
1005                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
1006                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)
1007                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
1008                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)
1009                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
1010                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE)
1011                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
1012                 if (dev->wiphy.wowlan.n_patterns) {
1013                         struct nl80211_wowlan_pattern_support pat = {
1014                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
1015                                 .min_pattern_len =
1016                                         dev->wiphy.wowlan.pattern_min_len,
1017                                 .max_pattern_len =
1018                                         dev->wiphy.wowlan.pattern_max_len,
1019                         };
1020                         NLA_PUT(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1021                                 sizeof(pat), &pat);
1022                 }
1023
1024                 nla_nest_end(msg, nl_wowlan);
1025         }
1026
1027         if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1028                                 dev->wiphy.software_iftypes))
1029                 goto nla_put_failure;
1030
1031         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
1032                 goto nla_put_failure;
1033
1034         if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME)
1035                 NLA_PUT_U32(msg, NL80211_ATTR_DEVICE_AP_SME,
1036                             dev->wiphy.ap_sme_capa);
1037
1038         NLA_PUT_U32(msg, NL80211_ATTR_FEATURE_FLAGS, dev->wiphy.features);
1039
1040         if (dev->wiphy.ht_capa_mod_mask)
1041                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1042                         sizeof(*dev->wiphy.ht_capa_mod_mask),
1043                         dev->wiphy.ht_capa_mod_mask);
1044
1045         return genlmsg_end(msg, hdr);
1046
1047  nla_put_failure:
1048         genlmsg_cancel(msg, hdr);
1049         return -EMSGSIZE;
1050 }
1051
1052 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1053 {
1054         int idx = 0;
1055         int start = cb->args[0];
1056         struct cfg80211_registered_device *dev;
1057
1058         mutex_lock(&cfg80211_mutex);
1059         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1060                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1061                         continue;
1062                 if (++idx <= start)
1063                         continue;
1064                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
1065                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1066                                        dev) < 0) {
1067                         idx--;
1068                         break;
1069                 }
1070         }
1071         mutex_unlock(&cfg80211_mutex);
1072
1073         cb->args[0] = idx;
1074
1075         return skb->len;
1076 }
1077
1078 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1079 {
1080         struct sk_buff *msg;
1081         struct cfg80211_registered_device *dev = info->user_ptr[0];
1082
1083         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1084         if (!msg)
1085                 return -ENOMEM;
1086
1087         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0) {
1088                 nlmsg_free(msg);
1089                 return -ENOBUFS;
1090         }
1091
1092         return genlmsg_reply(msg, info);
1093 }
1094
1095 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1096         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1097         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1098         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1099         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1100         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1101 };
1102
1103 static int parse_txq_params(struct nlattr *tb[],
1104                             struct ieee80211_txq_params *txq_params)
1105 {
1106         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1107             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1108             !tb[NL80211_TXQ_ATTR_AIFS])
1109                 return -EINVAL;
1110
1111         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
1112         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1113         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1114         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1115         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1116
1117         return 0;
1118 }
1119
1120 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1121 {
1122         /*
1123          * You can only set the channel explicitly for AP, mesh
1124          * and WDS type interfaces; all others have their channel
1125          * managed via their respective "establish a connection"
1126          * command (connect, join, ...)
1127          *
1128          * Monitors are special as they are normally slaved to
1129          * whatever else is going on, so they behave as though
1130          * you tried setting the wiphy channel itself.
1131          */
1132         return !wdev ||
1133                 wdev->iftype == NL80211_IFTYPE_AP ||
1134                 wdev->iftype == NL80211_IFTYPE_WDS ||
1135                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1136                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1137                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1138 }
1139
1140 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1141                                  struct wireless_dev *wdev,
1142                                  struct genl_info *info)
1143 {
1144         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
1145         u32 freq;
1146         int result;
1147
1148         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1149                 return -EINVAL;
1150
1151         if (!nl80211_can_set_dev_channel(wdev))
1152                 return -EOPNOTSUPP;
1153
1154         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1155                 channel_type = nla_get_u32(info->attrs[
1156                                    NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1157                 if (channel_type != NL80211_CHAN_NO_HT &&
1158                     channel_type != NL80211_CHAN_HT20 &&
1159                     channel_type != NL80211_CHAN_HT40PLUS &&
1160                     channel_type != NL80211_CHAN_HT40MINUS)
1161                         return -EINVAL;
1162         }
1163
1164         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1165
1166         mutex_lock(&rdev->devlist_mtx);
1167         if (wdev) {
1168                 wdev_lock(wdev);
1169                 result = cfg80211_set_freq(rdev, wdev, freq, channel_type);
1170                 wdev_unlock(wdev);
1171         } else {
1172                 result = cfg80211_set_freq(rdev, NULL, freq, channel_type);
1173         }
1174         mutex_unlock(&rdev->devlist_mtx);
1175
1176         return result;
1177 }
1178
1179 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1180 {
1181         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1182         struct net_device *netdev = info->user_ptr[1];
1183
1184         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1185 }
1186
1187 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1188 {
1189         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1190         struct net_device *dev = info->user_ptr[1];
1191         struct wireless_dev *wdev = dev->ieee80211_ptr;
1192         const u8 *bssid;
1193
1194         if (!info->attrs[NL80211_ATTR_MAC])
1195                 return -EINVAL;
1196
1197         if (netif_running(dev))
1198                 return -EBUSY;
1199
1200         if (!rdev->ops->set_wds_peer)
1201                 return -EOPNOTSUPP;
1202
1203         if (wdev->iftype != NL80211_IFTYPE_WDS)
1204                 return -EOPNOTSUPP;
1205
1206         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1207         return rdev->ops->set_wds_peer(wdev->wiphy, dev, bssid);
1208 }
1209
1210
1211 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1212 {
1213         struct cfg80211_registered_device *rdev;
1214         struct net_device *netdev = NULL;
1215         struct wireless_dev *wdev;
1216         int result = 0, rem_txq_params = 0;
1217         struct nlattr *nl_txq_params;
1218         u32 changed;
1219         u8 retry_short = 0, retry_long = 0;
1220         u32 frag_threshold = 0, rts_threshold = 0;
1221         u8 coverage_class = 0;
1222
1223         /*
1224          * Try to find the wiphy and netdev. Normally this
1225          * function shouldn't need the netdev, but this is
1226          * done for backward compatibility -- previously
1227          * setting the channel was done per wiphy, but now
1228          * it is per netdev. Previous userland like hostapd
1229          * also passed a netdev to set_wiphy, so that it is
1230          * possible to let that go to the right netdev!
1231          */
1232         mutex_lock(&cfg80211_mutex);
1233
1234         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1235                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1236
1237                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1238                 if (netdev && netdev->ieee80211_ptr) {
1239                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1240                         mutex_lock(&rdev->mtx);
1241                 } else
1242                         netdev = NULL;
1243         }
1244
1245         if (!netdev) {
1246                 rdev = __cfg80211_rdev_from_info(info);
1247                 if (IS_ERR(rdev)) {
1248                         mutex_unlock(&cfg80211_mutex);
1249                         return PTR_ERR(rdev);
1250                 }
1251                 wdev = NULL;
1252                 netdev = NULL;
1253                 result = 0;
1254
1255                 mutex_lock(&rdev->mtx);
1256         } else if (netif_running(netdev) &&
1257                    nl80211_can_set_dev_channel(netdev->ieee80211_ptr))
1258                 wdev = netdev->ieee80211_ptr;
1259         else
1260                 wdev = NULL;
1261
1262         /*
1263          * end workaround code, by now the rdev is available
1264          * and locked, and wdev may or may not be NULL.
1265          */
1266
1267         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1268                 result = cfg80211_dev_rename(
1269                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1270
1271         mutex_unlock(&cfg80211_mutex);
1272
1273         if (result)
1274                 goto bad_res;
1275
1276         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1277                 struct ieee80211_txq_params txq_params;
1278                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1279
1280                 if (!rdev->ops->set_txq_params) {
1281                         result = -EOPNOTSUPP;
1282                         goto bad_res;
1283                 }
1284
1285                 if (!netdev) {
1286                         result = -EINVAL;
1287                         goto bad_res;
1288                 }
1289
1290                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1291                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1292                         result = -EINVAL;
1293                         goto bad_res;
1294                 }
1295
1296                 nla_for_each_nested(nl_txq_params,
1297                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1298                                     rem_txq_params) {
1299                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1300                                   nla_data(nl_txq_params),
1301                                   nla_len(nl_txq_params),
1302                                   txq_params_policy);
1303                         result = parse_txq_params(tb, &txq_params);
1304                         if (result)
1305                                 goto bad_res;
1306
1307                         result = rdev->ops->set_txq_params(&rdev->wiphy,
1308                                                            netdev,
1309                                                            &txq_params);
1310                         if (result)
1311                                 goto bad_res;
1312                 }
1313         }
1314
1315         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1316                 result = __nl80211_set_channel(rdev, wdev, info);
1317                 if (result)
1318                         goto bad_res;
1319         }
1320
1321         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1322                 enum nl80211_tx_power_setting type;
1323                 int idx, mbm = 0;
1324
1325                 if (!rdev->ops->set_tx_power) {
1326                         result = -EOPNOTSUPP;
1327                         goto bad_res;
1328                 }
1329
1330                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1331                 type = nla_get_u32(info->attrs[idx]);
1332
1333                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1334                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1335                         result = -EINVAL;
1336                         goto bad_res;
1337                 }
1338
1339                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1340                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1341                         mbm = nla_get_u32(info->attrs[idx]);
1342                 }
1343
1344                 result = rdev->ops->set_tx_power(&rdev->wiphy, type, mbm);
1345                 if (result)
1346                         goto bad_res;
1347         }
1348
1349         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1350             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1351                 u32 tx_ant, rx_ant;
1352                 if ((!rdev->wiphy.available_antennas_tx &&
1353                      !rdev->wiphy.available_antennas_rx) ||
1354                     !rdev->ops->set_antenna) {
1355                         result = -EOPNOTSUPP;
1356                         goto bad_res;
1357                 }
1358
1359                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1360                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1361
1362                 /* reject antenna configurations which don't match the
1363                  * available antenna masks, except for the "all" mask */
1364                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1365                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1366                         result = -EINVAL;
1367                         goto bad_res;
1368                 }
1369
1370                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1371                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1372
1373                 result = rdev->ops->set_antenna(&rdev->wiphy, tx_ant, rx_ant);
1374                 if (result)
1375                         goto bad_res;
1376         }
1377
1378         changed = 0;
1379
1380         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1381                 retry_short = nla_get_u8(
1382                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1383                 if (retry_short == 0) {
1384                         result = -EINVAL;
1385                         goto bad_res;
1386                 }
1387                 changed |= WIPHY_PARAM_RETRY_SHORT;
1388         }
1389
1390         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1391                 retry_long = nla_get_u8(
1392                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1393                 if (retry_long == 0) {
1394                         result = -EINVAL;
1395                         goto bad_res;
1396                 }
1397                 changed |= WIPHY_PARAM_RETRY_LONG;
1398         }
1399
1400         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1401                 frag_threshold = nla_get_u32(
1402                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1403                 if (frag_threshold < 256) {
1404                         result = -EINVAL;
1405                         goto bad_res;
1406                 }
1407                 if (frag_threshold != (u32) -1) {
1408                         /*
1409                          * Fragments (apart from the last one) are required to
1410                          * have even length. Make the fragmentation code
1411                          * simpler by stripping LSB should someone try to use
1412                          * odd threshold value.
1413                          */
1414                         frag_threshold &= ~0x1;
1415                 }
1416                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1417         }
1418
1419         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1420                 rts_threshold = nla_get_u32(
1421                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1422                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1423         }
1424
1425         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1426                 coverage_class = nla_get_u8(
1427                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1428                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1429         }
1430
1431         if (changed) {
1432                 u8 old_retry_short, old_retry_long;
1433                 u32 old_frag_threshold, old_rts_threshold;
1434                 u8 old_coverage_class;
1435
1436                 if (!rdev->ops->set_wiphy_params) {
1437                         result = -EOPNOTSUPP;
1438                         goto bad_res;
1439                 }
1440
1441                 old_retry_short = rdev->wiphy.retry_short;
1442                 old_retry_long = rdev->wiphy.retry_long;
1443                 old_frag_threshold = rdev->wiphy.frag_threshold;
1444                 old_rts_threshold = rdev->wiphy.rts_threshold;
1445                 old_coverage_class = rdev->wiphy.coverage_class;
1446
1447                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1448                         rdev->wiphy.retry_short = retry_short;
1449                 if (changed & WIPHY_PARAM_RETRY_LONG)
1450                         rdev->wiphy.retry_long = retry_long;
1451                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1452                         rdev->wiphy.frag_threshold = frag_threshold;
1453                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1454                         rdev->wiphy.rts_threshold = rts_threshold;
1455                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1456                         rdev->wiphy.coverage_class = coverage_class;
1457
1458                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
1459                 if (result) {
1460                         rdev->wiphy.retry_short = old_retry_short;
1461                         rdev->wiphy.retry_long = old_retry_long;
1462                         rdev->wiphy.frag_threshold = old_frag_threshold;
1463                         rdev->wiphy.rts_threshold = old_rts_threshold;
1464                         rdev->wiphy.coverage_class = old_coverage_class;
1465                 }
1466         }
1467
1468  bad_res:
1469         mutex_unlock(&rdev->mtx);
1470         if (netdev)
1471                 dev_put(netdev);
1472         return result;
1473 }
1474
1475
1476 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
1477                               struct cfg80211_registered_device *rdev,
1478                               struct net_device *dev)
1479 {
1480         void *hdr;
1481
1482         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1483         if (!hdr)
1484                 return -1;
1485
1486         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1487         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
1488         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
1489         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
1490
1491         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
1492                     rdev->devlist_generation ^
1493                         (cfg80211_rdev_list_generation << 2));
1494
1495         return genlmsg_end(msg, hdr);
1496
1497  nla_put_failure:
1498         genlmsg_cancel(msg, hdr);
1499         return -EMSGSIZE;
1500 }
1501
1502 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1503 {
1504         int wp_idx = 0;
1505         int if_idx = 0;
1506         int wp_start = cb->args[0];
1507         int if_start = cb->args[1];
1508         struct cfg80211_registered_device *rdev;
1509         struct wireless_dev *wdev;
1510
1511         mutex_lock(&cfg80211_mutex);
1512         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1513                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1514                         continue;
1515                 if (wp_idx < wp_start) {
1516                         wp_idx++;
1517                         continue;
1518                 }
1519                 if_idx = 0;
1520
1521                 mutex_lock(&rdev->devlist_mtx);
1522                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
1523                         if (if_idx < if_start) {
1524                                 if_idx++;
1525                                 continue;
1526                         }
1527                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
1528                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1529                                                rdev, wdev->netdev) < 0) {
1530                                 mutex_unlock(&rdev->devlist_mtx);
1531                                 goto out;
1532                         }
1533                         if_idx++;
1534                 }
1535                 mutex_unlock(&rdev->devlist_mtx);
1536
1537                 wp_idx++;
1538         }
1539  out:
1540         mutex_unlock(&cfg80211_mutex);
1541
1542         cb->args[0] = wp_idx;
1543         cb->args[1] = if_idx;
1544
1545         return skb->len;
1546 }
1547
1548 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1549 {
1550         struct sk_buff *msg;
1551         struct cfg80211_registered_device *dev = info->user_ptr[0];
1552         struct net_device *netdev = info->user_ptr[1];
1553
1554         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1555         if (!msg)
1556                 return -ENOMEM;
1557
1558         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
1559                                dev, netdev) < 0) {
1560                 nlmsg_free(msg);
1561                 return -ENOBUFS;
1562         }
1563
1564         return genlmsg_reply(msg, info);
1565 }
1566
1567 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1568         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1569         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1570         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1571         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1572         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1573 };
1574
1575 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1576 {
1577         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1578         int flag;
1579
1580         *mntrflags = 0;
1581
1582         if (!nla)
1583                 return -EINVAL;
1584
1585         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1586                              nla, mntr_flags_policy))
1587                 return -EINVAL;
1588
1589         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1590                 if (flags[flag])
1591                         *mntrflags |= (1<<flag);
1592
1593         return 0;
1594 }
1595
1596 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1597                                struct net_device *netdev, u8 use_4addr,
1598                                enum nl80211_iftype iftype)
1599 {
1600         if (!use_4addr) {
1601                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1602                         return -EBUSY;
1603                 return 0;
1604         }
1605
1606         switch (iftype) {
1607         case NL80211_IFTYPE_AP_VLAN:
1608                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1609                         return 0;
1610                 break;
1611         case NL80211_IFTYPE_STATION:
1612                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1613                         return 0;
1614                 break;
1615         default:
1616                 break;
1617         }
1618
1619         return -EOPNOTSUPP;
1620 }
1621
1622 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1623 {
1624         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1625         struct vif_params params;
1626         int err;
1627         enum nl80211_iftype otype, ntype;
1628         struct net_device *dev = info->user_ptr[1];
1629         u32 _flags, *flags = NULL;
1630         bool change = false;
1631
1632         memset(&params, 0, sizeof(params));
1633
1634         otype = ntype = dev->ieee80211_ptr->iftype;
1635
1636         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1637                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1638                 if (otype != ntype)
1639                         change = true;
1640                 if (ntype > NL80211_IFTYPE_MAX)
1641                         return -EINVAL;
1642         }
1643
1644         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1645                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1646
1647                 if (ntype != NL80211_IFTYPE_MESH_POINT)
1648                         return -EINVAL;
1649                 if (netif_running(dev))
1650                         return -EBUSY;
1651
1652                 wdev_lock(wdev);
1653                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1654                              IEEE80211_MAX_MESH_ID_LEN);
1655                 wdev->mesh_id_up_len =
1656                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1657                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1658                        wdev->mesh_id_up_len);
1659                 wdev_unlock(wdev);
1660         }
1661
1662         if (info->attrs[NL80211_ATTR_4ADDR]) {
1663                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1664                 change = true;
1665                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1666                 if (err)
1667                         return err;
1668         } else {
1669                 params.use_4addr = -1;
1670         }
1671
1672         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1673                 if (ntype != NL80211_IFTYPE_MONITOR)
1674                         return -EINVAL;
1675                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1676                                           &_flags);
1677                 if (err)
1678                         return err;
1679
1680                 flags = &_flags;
1681                 change = true;
1682         }
1683
1684         if (change)
1685                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1686         else
1687                 err = 0;
1688
1689         if (!err && params.use_4addr != -1)
1690                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1691
1692         return err;
1693 }
1694
1695 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1696 {
1697         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1698         struct vif_params params;
1699         struct net_device *dev;
1700         int err;
1701         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1702         u32 flags;
1703
1704         memset(&params, 0, sizeof(params));
1705
1706         if (!info->attrs[NL80211_ATTR_IFNAME])
1707                 return -EINVAL;
1708
1709         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1710                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1711                 if (type > NL80211_IFTYPE_MAX)
1712                         return -EINVAL;
1713         }
1714
1715         if (!rdev->ops->add_virtual_intf ||
1716             !(rdev->wiphy.interface_modes & (1 << type)))
1717                 return -EOPNOTSUPP;
1718
1719         if (info->attrs[NL80211_ATTR_4ADDR]) {
1720                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1721                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1722                 if (err)
1723                         return err;
1724         }
1725
1726         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1727                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1728                                   &flags);
1729         dev = rdev->ops->add_virtual_intf(&rdev->wiphy,
1730                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1731                 type, err ? NULL : &flags, &params);
1732         if (IS_ERR(dev))
1733                 return PTR_ERR(dev);
1734
1735         if (type == NL80211_IFTYPE_MESH_POINT &&
1736             info->attrs[NL80211_ATTR_MESH_ID]) {
1737                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1738
1739                 wdev_lock(wdev);
1740                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1741                              IEEE80211_MAX_MESH_ID_LEN);
1742                 wdev->mesh_id_up_len =
1743                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1744                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1745                        wdev->mesh_id_up_len);
1746                 wdev_unlock(wdev);
1747         }
1748
1749         return 0;
1750 }
1751
1752 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1753 {
1754         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1755         struct net_device *dev = info->user_ptr[1];
1756
1757         if (!rdev->ops->del_virtual_intf)
1758                 return -EOPNOTSUPP;
1759
1760         return rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1761 }
1762
1763 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
1764 {
1765         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1766         struct net_device *dev = info->user_ptr[1];
1767         u16 noack_map;
1768
1769         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
1770                 return -EINVAL;
1771
1772         if (!rdev->ops->set_noack_map)
1773                 return -EOPNOTSUPP;
1774
1775         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
1776
1777         return rdev->ops->set_noack_map(&rdev->wiphy, dev, noack_map);
1778 }
1779
1780 struct get_key_cookie {
1781         struct sk_buff *msg;
1782         int error;
1783         int idx;
1784 };
1785
1786 static void get_key_callback(void *c, struct key_params *params)
1787 {
1788         struct nlattr *key;
1789         struct get_key_cookie *cookie = c;
1790
1791         if (params->key)
1792                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1793                         params->key_len, params->key);
1794
1795         if (params->seq)
1796                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1797                         params->seq_len, params->seq);
1798
1799         if (params->cipher)
1800                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1801                             params->cipher);
1802
1803         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1804         if (!key)
1805                 goto nla_put_failure;
1806
1807         if (params->key)
1808                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1809                         params->key_len, params->key);
1810
1811         if (params->seq)
1812                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1813                         params->seq_len, params->seq);
1814
1815         if (params->cipher)
1816                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1817                             params->cipher);
1818
1819         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1820
1821         nla_nest_end(cookie->msg, key);
1822
1823         return;
1824  nla_put_failure:
1825         cookie->error = 1;
1826 }
1827
1828 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1829 {
1830         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1831         int err;
1832         struct net_device *dev = info->user_ptr[1];
1833         u8 key_idx = 0;
1834         const u8 *mac_addr = NULL;
1835         bool pairwise;
1836         struct get_key_cookie cookie = {
1837                 .error = 0,
1838         };
1839         void *hdr;
1840         struct sk_buff *msg;
1841
1842         if (info->attrs[NL80211_ATTR_KEY_IDX])
1843                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1844
1845         if (key_idx > 5)
1846                 return -EINVAL;
1847
1848         if (info->attrs[NL80211_ATTR_MAC])
1849                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1850
1851         pairwise = !!mac_addr;
1852         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
1853                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1854                 if (kt >= NUM_NL80211_KEYTYPES)
1855                         return -EINVAL;
1856                 if (kt != NL80211_KEYTYPE_GROUP &&
1857                     kt != NL80211_KEYTYPE_PAIRWISE)
1858                         return -EINVAL;
1859                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
1860         }
1861
1862         if (!rdev->ops->get_key)
1863                 return -EOPNOTSUPP;
1864
1865         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1866         if (!msg)
1867                 return -ENOMEM;
1868
1869         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1870                              NL80211_CMD_NEW_KEY);
1871         if (IS_ERR(hdr))
1872                 return PTR_ERR(hdr);
1873
1874         cookie.msg = msg;
1875         cookie.idx = key_idx;
1876
1877         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1878         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1879         if (mac_addr)
1880                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1881
1882         if (pairwise && mac_addr &&
1883             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1884                 return -ENOENT;
1885
1886         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, pairwise,
1887                                  mac_addr, &cookie, get_key_callback);
1888
1889         if (err)
1890                 goto free_msg;
1891
1892         if (cookie.error)
1893                 goto nla_put_failure;
1894
1895         genlmsg_end(msg, hdr);
1896         return genlmsg_reply(msg, info);
1897
1898  nla_put_failure:
1899         err = -ENOBUFS;
1900  free_msg:
1901         nlmsg_free(msg);
1902         return err;
1903 }
1904
1905 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1906 {
1907         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1908         struct key_parse key;
1909         int err;
1910         struct net_device *dev = info->user_ptr[1];
1911
1912         err = nl80211_parse_key(info, &key);
1913         if (err)
1914                 return err;
1915
1916         if (key.idx < 0)
1917                 return -EINVAL;
1918
1919         /* only support setting default key */
1920         if (!key.def && !key.defmgmt)
1921                 return -EINVAL;
1922
1923         wdev_lock(dev->ieee80211_ptr);
1924
1925         if (key.def) {
1926                 if (!rdev->ops->set_default_key) {
1927                         err = -EOPNOTSUPP;
1928                         goto out;
1929                 }
1930
1931                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1932                 if (err)
1933                         goto out;
1934
1935                 err = rdev->ops->set_default_key(&rdev->wiphy, dev, key.idx,
1936                                                  key.def_uni, key.def_multi);
1937
1938                 if (err)
1939                         goto out;
1940
1941 #ifdef CONFIG_CFG80211_WEXT
1942                 dev->ieee80211_ptr->wext.default_key = key.idx;
1943 #endif
1944         } else {
1945                 if (key.def_uni || !key.def_multi) {
1946                         err = -EINVAL;
1947                         goto out;
1948                 }
1949
1950                 if (!rdev->ops->set_default_mgmt_key) {
1951                         err = -EOPNOTSUPP;
1952                         goto out;
1953                 }
1954
1955                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1956                 if (err)
1957                         goto out;
1958
1959                 err = rdev->ops->set_default_mgmt_key(&rdev->wiphy,
1960                                                       dev, key.idx);
1961                 if (err)
1962                         goto out;
1963
1964 #ifdef CONFIG_CFG80211_WEXT
1965                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1966 #endif
1967         }
1968
1969  out:
1970         wdev_unlock(dev->ieee80211_ptr);
1971
1972         return err;
1973 }
1974
1975 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1976 {
1977         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1978         int err;
1979         struct net_device *dev = info->user_ptr[1];
1980         struct key_parse key;
1981         const u8 *mac_addr = NULL;
1982
1983         err = nl80211_parse_key(info, &key);
1984         if (err)
1985                 return err;
1986
1987         if (!key.p.key)
1988                 return -EINVAL;
1989
1990         if (info->attrs[NL80211_ATTR_MAC])
1991                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1992
1993         if (key.type == -1) {
1994                 if (mac_addr)
1995                         key.type = NL80211_KEYTYPE_PAIRWISE;
1996                 else
1997                         key.type = NL80211_KEYTYPE_GROUP;
1998         }
1999
2000         /* for now */
2001         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2002             key.type != NL80211_KEYTYPE_GROUP)
2003                 return -EINVAL;
2004
2005         if (!rdev->ops->add_key)
2006                 return -EOPNOTSUPP;
2007
2008         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2009                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2010                                            mac_addr))
2011                 return -EINVAL;
2012
2013         wdev_lock(dev->ieee80211_ptr);
2014         err = nl80211_key_allowed(dev->ieee80211_ptr);
2015         if (!err)
2016                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
2017                                          key.type == NL80211_KEYTYPE_PAIRWISE,
2018                                          mac_addr, &key.p);
2019         wdev_unlock(dev->ieee80211_ptr);
2020
2021         return err;
2022 }
2023
2024 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2025 {
2026         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2027         int err;
2028         struct net_device *dev = info->user_ptr[1];
2029         u8 *mac_addr = NULL;
2030         struct key_parse key;
2031
2032         err = nl80211_parse_key(info, &key);
2033         if (err)
2034                 return err;
2035
2036         if (info->attrs[NL80211_ATTR_MAC])
2037                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2038
2039         if (key.type == -1) {
2040                 if (mac_addr)
2041                         key.type = NL80211_KEYTYPE_PAIRWISE;
2042                 else
2043                         key.type = NL80211_KEYTYPE_GROUP;
2044         }
2045
2046         /* for now */
2047         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2048             key.type != NL80211_KEYTYPE_GROUP)
2049                 return -EINVAL;
2050
2051         if (!rdev->ops->del_key)
2052                 return -EOPNOTSUPP;
2053
2054         wdev_lock(dev->ieee80211_ptr);
2055         err = nl80211_key_allowed(dev->ieee80211_ptr);
2056
2057         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2058             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2059                 err = -ENOENT;
2060
2061         if (!err)
2062                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx,
2063                                          key.type == NL80211_KEYTYPE_PAIRWISE,
2064                                          mac_addr);
2065
2066 #ifdef CONFIG_CFG80211_WEXT
2067         if (!err) {
2068                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2069                         dev->ieee80211_ptr->wext.default_key = -1;
2070                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2071                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2072         }
2073 #endif
2074         wdev_unlock(dev->ieee80211_ptr);
2075
2076         return err;
2077 }
2078
2079 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
2080 {
2081         int (*call)(struct wiphy *wiphy, struct net_device *dev,
2082                     struct beacon_parameters *info);
2083         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2084         struct net_device *dev = info->user_ptr[1];
2085         struct wireless_dev *wdev = dev->ieee80211_ptr;
2086         struct beacon_parameters params;
2087         int haveinfo = 0, err;
2088
2089         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2090             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2091             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2092             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2093                 return -EINVAL;
2094
2095         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2096             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2097                 return -EOPNOTSUPP;
2098
2099         memset(&params, 0, sizeof(params));
2100
2101         switch (info->genlhdr->cmd) {
2102         case NL80211_CMD_NEW_BEACON:
2103                 /* these are required for NEW_BEACON */
2104                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
2105                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
2106                     !info->attrs[NL80211_ATTR_BEACON_HEAD])
2107                         return -EINVAL;
2108
2109                 params.interval =
2110                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2111                 params.dtim_period =
2112                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2113
2114                 err = cfg80211_validate_beacon_int(rdev, params.interval);
2115                 if (err)
2116                         return err;
2117
2118                 /*
2119                  * In theory, some of these attributes could be required for
2120                  * NEW_BEACON, but since they were not used when the command was
2121                  * originally added, keep them optional for old user space
2122                  * programs to work with drivers that do not need the additional
2123                  * information.
2124                  */
2125                 if (info->attrs[NL80211_ATTR_SSID]) {
2126                         params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2127                         params.ssid_len =
2128                                 nla_len(info->attrs[NL80211_ATTR_SSID]);
2129                         if (params.ssid_len == 0 ||
2130                             params.ssid_len > IEEE80211_MAX_SSID_LEN)
2131                                 return -EINVAL;
2132                 }
2133
2134                 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
2135                         params.hidden_ssid = nla_get_u32(
2136                                 info->attrs[NL80211_ATTR_HIDDEN_SSID]);
2137                         if (params.hidden_ssid !=
2138                             NL80211_HIDDEN_SSID_NOT_IN_USE &&
2139                             params.hidden_ssid !=
2140                             NL80211_HIDDEN_SSID_ZERO_LEN &&
2141                             params.hidden_ssid !=
2142                             NL80211_HIDDEN_SSID_ZERO_CONTENTS)
2143                                 return -EINVAL;
2144                 }
2145
2146                 params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
2147
2148                 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2149                         params.auth_type = nla_get_u32(
2150                                 info->attrs[NL80211_ATTR_AUTH_TYPE]);
2151                         if (!nl80211_valid_auth_type(params.auth_type))
2152                                 return -EINVAL;
2153                 } else
2154                         params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
2155
2156                 err = nl80211_crypto_settings(rdev, info, &params.crypto,
2157                                               NL80211_MAX_NR_CIPHER_SUITES);
2158                 if (err)
2159                         return err;
2160
2161                 call = rdev->ops->add_beacon;
2162                 break;
2163         case NL80211_CMD_SET_BEACON:
2164                 call = rdev->ops->set_beacon;
2165                 break;
2166         default:
2167                 WARN_ON(1);
2168                 return -EOPNOTSUPP;
2169         }
2170
2171         if (!call)
2172                 return -EOPNOTSUPP;
2173
2174         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2175                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2176                 params.head_len =
2177                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2178                 haveinfo = 1;
2179         }
2180
2181         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2182                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2183                 params.tail_len =
2184                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2185                 haveinfo = 1;
2186         }
2187
2188         if (!haveinfo)
2189                 return -EINVAL;
2190
2191         if (info->attrs[NL80211_ATTR_IE]) {
2192                 params.beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2193                 params.beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2194         }
2195
2196         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2197                 params.proberesp_ies =
2198                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2199                 params.proberesp_ies_len =
2200                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2201         }
2202
2203         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2204                 params.assocresp_ies =
2205                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2206                 params.assocresp_ies_len =
2207                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2208         }
2209
2210         if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
2211                 params.probe_resp =
2212                         nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
2213                 params.probe_resp_len =
2214                         nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
2215         }
2216
2217         err = call(&rdev->wiphy, dev, &params);
2218         if (!err && params.interval)
2219                 wdev->beacon_interval = params.interval;
2220         return err;
2221 }
2222
2223 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
2224 {
2225         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2226         struct net_device *dev = info->user_ptr[1];
2227         struct wireless_dev *wdev = dev->ieee80211_ptr;
2228         int err;
2229
2230         if (!rdev->ops->del_beacon)
2231                 return -EOPNOTSUPP;
2232
2233         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2234             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2235                 return -EOPNOTSUPP;
2236
2237         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
2238         if (!err)
2239                 wdev->beacon_interval = 0;
2240         return err;
2241 }
2242
2243 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
2244         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
2245         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
2246         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
2247         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
2248         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
2249         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
2250 };
2251
2252 static int parse_station_flags(struct genl_info *info,
2253                                struct station_parameters *params)
2254 {
2255         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
2256         struct nlattr *nla;
2257         int flag;
2258
2259         /*
2260          * Try parsing the new attribute first so userspace
2261          * can specify both for older kernels.
2262          */
2263         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
2264         if (nla) {
2265                 struct nl80211_sta_flag_update *sta_flags;
2266
2267                 sta_flags = nla_data(nla);
2268                 params->sta_flags_mask = sta_flags->mask;
2269                 params->sta_flags_set = sta_flags->set;
2270                 if ((params->sta_flags_mask |
2271                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
2272                         return -EINVAL;
2273                 return 0;
2274         }
2275
2276         /* if present, parse the old attribute */
2277
2278         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
2279         if (!nla)
2280                 return 0;
2281
2282         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
2283                              nla, sta_flags_policy))
2284                 return -EINVAL;
2285
2286         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
2287         params->sta_flags_mask &= ~1;
2288
2289         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
2290                 if (flags[flag])
2291                         params->sta_flags_set |= (1<<flag);
2292
2293         return 0;
2294 }
2295
2296 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
2297                                  int attr)
2298 {
2299         struct nlattr *rate;
2300         u16 bitrate;
2301
2302         rate = nla_nest_start(msg, attr);
2303         if (!rate)
2304                 goto nla_put_failure;
2305
2306         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
2307         bitrate = cfg80211_calculate_bitrate(info);
2308         if (bitrate > 0)
2309                 NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
2310
2311         if (info->flags & RATE_INFO_FLAGS_MCS)
2312                 NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS, info->mcs);
2313         if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
2314                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
2315         if (info->flags & RATE_INFO_FLAGS_SHORT_GI)
2316                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
2317
2318         nla_nest_end(msg, rate);
2319         return true;
2320
2321 nla_put_failure:
2322         return false;
2323 }
2324
2325 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
2326                                 int flags, struct net_device *dev,
2327                                 const u8 *mac_addr, struct station_info *sinfo)
2328 {
2329         void *hdr;
2330         struct nlattr *sinfoattr, *bss_param;
2331
2332         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2333         if (!hdr)
2334                 return -1;
2335
2336         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2337         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
2338
2339         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
2340
2341         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
2342         if (!sinfoattr)
2343                 goto nla_put_failure;
2344         if (sinfo->filled & STATION_INFO_CONNECTED_TIME)
2345                 NLA_PUT_U32(msg, NL80211_STA_INFO_CONNECTED_TIME,
2346                             sinfo->connected_time);
2347         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
2348                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
2349                             sinfo->inactive_time);
2350         if (sinfo->filled & STATION_INFO_RX_BYTES)
2351                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
2352                             sinfo->rx_bytes);
2353         if (sinfo->filled & STATION_INFO_TX_BYTES)
2354                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
2355                             sinfo->tx_bytes);
2356         if (sinfo->filled & STATION_INFO_LLID)
2357                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
2358                             sinfo->llid);
2359         if (sinfo->filled & STATION_INFO_PLID)
2360                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
2361                             sinfo->plid);
2362         if (sinfo->filled & STATION_INFO_PLINK_STATE)
2363                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
2364                             sinfo->plink_state);
2365         if (sinfo->filled & STATION_INFO_SIGNAL)
2366                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
2367                            sinfo->signal);
2368         if (sinfo->filled & STATION_INFO_SIGNAL_AVG)
2369                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL_AVG,
2370                            sinfo->signal_avg);
2371         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
2372                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
2373                                           NL80211_STA_INFO_TX_BITRATE))
2374                         goto nla_put_failure;
2375         }
2376         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
2377                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
2378                                           NL80211_STA_INFO_RX_BITRATE))
2379                         goto nla_put_failure;
2380         }
2381         if (sinfo->filled & STATION_INFO_RX_PACKETS)
2382                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
2383                             sinfo->rx_packets);
2384         if (sinfo->filled & STATION_INFO_TX_PACKETS)
2385                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
2386                             sinfo->tx_packets);
2387         if (sinfo->filled & STATION_INFO_TX_RETRIES)
2388                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_RETRIES,
2389                             sinfo->tx_retries);
2390         if (sinfo->filled & STATION_INFO_TX_FAILED)
2391                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_FAILED,
2392                             sinfo->tx_failed);
2393         if (sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT)
2394                 NLA_PUT_U32(msg, NL80211_STA_INFO_BEACON_LOSS,
2395                             sinfo->beacon_loss_count);
2396         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
2397                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
2398                 if (!bss_param)
2399                         goto nla_put_failure;
2400
2401                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT)
2402                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_CTS_PROT);
2403                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE)
2404                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE);
2405                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME)
2406                         NLA_PUT_FLAG(msg,
2407                                      NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME);
2408                 NLA_PUT_U8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
2409                            sinfo->bss_param.dtim_period);
2410                 NLA_PUT_U16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
2411                             sinfo->bss_param.beacon_interval);
2412
2413                 nla_nest_end(msg, bss_param);
2414         }
2415         if (sinfo->filled & STATION_INFO_STA_FLAGS)
2416                 NLA_PUT(msg, NL80211_STA_INFO_STA_FLAGS,
2417                         sizeof(struct nl80211_sta_flag_update),
2418                         &sinfo->sta_flags);
2419         nla_nest_end(msg, sinfoattr);
2420
2421         if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES)
2422                 NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
2423                         sinfo->assoc_req_ies);
2424
2425         return genlmsg_end(msg, hdr);
2426
2427  nla_put_failure:
2428         genlmsg_cancel(msg, hdr);
2429         return -EMSGSIZE;
2430 }
2431
2432 static int nl80211_dump_station(struct sk_buff *skb,
2433                                 struct netlink_callback *cb)
2434 {
2435         struct station_info sinfo;
2436         struct cfg80211_registered_device *dev;
2437         struct net_device *netdev;
2438         u8 mac_addr[ETH_ALEN];
2439         int sta_idx = cb->args[1];
2440         int err;
2441
2442         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2443         if (err)
2444                 return err;
2445
2446         if (!dev->ops->dump_station) {
2447                 err = -EOPNOTSUPP;
2448                 goto out_err;
2449         }
2450
2451         while (1) {
2452                 memset(&sinfo, 0, sizeof(sinfo));
2453                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
2454                                              mac_addr, &sinfo);
2455                 if (err == -ENOENT)
2456                         break;
2457                 if (err)
2458                         goto out_err;
2459
2460                 if (nl80211_send_station(skb,
2461                                 NETLINK_CB(cb->skb).pid,
2462                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2463                                 netdev, mac_addr,
2464                                 &sinfo) < 0)
2465                         goto out;
2466
2467                 sta_idx++;
2468         }
2469
2470
2471  out:
2472         cb->args[1] = sta_idx;
2473         err = skb->len;
2474  out_err:
2475         nl80211_finish_netdev_dump(dev);
2476
2477         return err;
2478 }
2479
2480 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
2481 {
2482         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2483         struct net_device *dev = info->user_ptr[1];
2484         struct station_info sinfo;
2485         struct sk_buff *msg;
2486         u8 *mac_addr = NULL;
2487         int err;
2488
2489         memset(&sinfo, 0, sizeof(sinfo));
2490
2491         if (!info->attrs[NL80211_ATTR_MAC])
2492                 return -EINVAL;
2493
2494         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2495
2496         if (!rdev->ops->get_station)
2497                 return -EOPNOTSUPP;
2498
2499         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
2500         if (err)
2501                 return err;
2502
2503         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2504         if (!msg)
2505                 return -ENOMEM;
2506
2507         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
2508                                  dev, mac_addr, &sinfo) < 0) {
2509                 nlmsg_free(msg);
2510                 return -ENOBUFS;
2511         }
2512
2513         return genlmsg_reply(msg, info);
2514 }
2515
2516 /*
2517  * Get vlan interface making sure it is running and on the right wiphy.
2518  */
2519 static struct net_device *get_vlan(struct genl_info *info,
2520                                    struct cfg80211_registered_device *rdev)
2521 {
2522         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
2523         struct net_device *v;
2524         int ret;
2525
2526         if (!vlanattr)
2527                 return NULL;
2528
2529         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
2530         if (!v)
2531                 return ERR_PTR(-ENODEV);
2532
2533         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
2534                 ret = -EINVAL;
2535                 goto error;
2536         }
2537
2538         if (!netif_running(v)) {
2539                 ret = -ENETDOWN;
2540                 goto error;
2541         }
2542
2543         return v;
2544  error:
2545         dev_put(v);
2546         return ERR_PTR(ret);
2547 }
2548
2549 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
2550 {
2551         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2552         int err;
2553         struct net_device *dev = info->user_ptr[1];
2554         struct station_parameters params;
2555         u8 *mac_addr = NULL;
2556
2557         memset(&params, 0, sizeof(params));
2558
2559         params.listen_interval = -1;
2560         params.plink_state = -1;
2561
2562         if (info->attrs[NL80211_ATTR_STA_AID])
2563                 return -EINVAL;
2564
2565         if (!info->attrs[NL80211_ATTR_MAC])
2566                 return -EINVAL;
2567
2568         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2569
2570         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
2571                 params.supported_rates =
2572                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2573                 params.supported_rates_len =
2574                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2575         }
2576
2577         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2578                 params.listen_interval =
2579                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2580
2581         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2582                 params.ht_capa =
2583                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2584
2585         if (!rdev->ops->change_station)
2586                 return -EOPNOTSUPP;
2587
2588         if (parse_station_flags(info, &params))
2589                 return -EINVAL;
2590
2591         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2592                 params.plink_action =
2593                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2594
2595         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
2596                 params.plink_state =
2597                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
2598
2599         switch (dev->ieee80211_ptr->iftype) {
2600         case NL80211_IFTYPE_AP:
2601         case NL80211_IFTYPE_AP_VLAN:
2602         case NL80211_IFTYPE_P2P_GO:
2603                 /* disallow mesh-specific things */
2604                 if (params.plink_action)
2605                         return -EINVAL;
2606
2607                 /* TDLS can't be set, ... */
2608                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
2609                         return -EINVAL;
2610                 /*
2611                  * ... but don't bother the driver with it. This works around
2612                  * a hostapd/wpa_supplicant issue -- it always includes the
2613                  * TLDS_PEER flag in the mask even for AP mode.
2614                  */
2615                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
2616
2617                 /* accept only the listed bits */
2618                 if (params.sta_flags_mask &
2619                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
2620                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
2621                                   BIT(NL80211_STA_FLAG_WME) |
2622                                   BIT(NL80211_STA_FLAG_MFP)))
2623                         return -EINVAL;
2624
2625                 /* must be last in here for error handling */
2626                 params.vlan = get_vlan(info, rdev);
2627                 if (IS_ERR(params.vlan))
2628                         return PTR_ERR(params.vlan);
2629                 break;
2630         case NL80211_IFTYPE_P2P_CLIENT:
2631         case NL80211_IFTYPE_STATION:
2632                 /* disallow things sta doesn't support */
2633                 if (params.plink_action)
2634                         return -EINVAL;
2635                 if (params.ht_capa)
2636                         return -EINVAL;
2637                 if (params.listen_interval >= 0)
2638                         return -EINVAL;
2639                 /*
2640                  * Don't allow userspace to change the TDLS_PEER flag,
2641                  * but silently ignore attempts to change it since we
2642                  * don't have state here to verify that it doesn't try
2643                  * to change the flag.
2644                  */
2645                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
2646
2647                 /* reject any changes other than AUTHORIZED */
2648                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
2649                         return -EINVAL;
2650                 break;
2651         case NL80211_IFTYPE_MESH_POINT:
2652                 /* disallow things mesh doesn't support */
2653                 if (params.vlan)
2654                         return -EINVAL;
2655                 if (params.ht_capa)
2656                         return -EINVAL;
2657                 if (params.listen_interval >= 0)
2658                         return -EINVAL;
2659                 /*
2660                  * No special handling for TDLS here -- the userspace
2661                  * mesh code doesn't have this bug.
2662                  */
2663                 if (params.sta_flags_mask &
2664                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2665                                   BIT(NL80211_STA_FLAG_MFP) |
2666                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
2667                         return -EINVAL;
2668                 break;
2669         default:
2670                 return -EOPNOTSUPP;
2671         }
2672
2673         /* be aware of params.vlan when changing code here */
2674
2675         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
2676
2677         if (params.vlan)
2678                 dev_put(params.vlan);
2679
2680         return err;
2681 }
2682
2683 static struct nla_policy
2684 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
2685         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
2686         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
2687 };
2688
2689 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
2690 {
2691         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2692         int err;
2693         struct net_device *dev = info->user_ptr[1];
2694         struct station_parameters params;
2695         u8 *mac_addr = NULL;
2696
2697         memset(&params, 0, sizeof(params));
2698
2699         if (!info->attrs[NL80211_ATTR_MAC])
2700                 return -EINVAL;
2701
2702         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2703                 return -EINVAL;
2704
2705         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2706                 return -EINVAL;
2707
2708         if (!info->attrs[NL80211_ATTR_STA_AID])
2709                 return -EINVAL;
2710
2711         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2712         params.supported_rates =
2713                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2714         params.supported_rates_len =
2715                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2716         params.listen_interval =
2717                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2718
2719         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2720         if (!params.aid || params.aid > IEEE80211_MAX_AID)
2721                 return -EINVAL;
2722
2723         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2724                 params.ht_capa =
2725                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2726
2727         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2728                 params.plink_action =
2729                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2730
2731         if (!rdev->ops->add_station)
2732                 return -EOPNOTSUPP;
2733
2734         if (parse_station_flags(info, &params))
2735                 return -EINVAL;
2736
2737         switch (dev->ieee80211_ptr->iftype) {
2738         case NL80211_IFTYPE_AP:
2739         case NL80211_IFTYPE_AP_VLAN:
2740         case NL80211_IFTYPE_P2P_GO:
2741                 /* parse WME attributes if sta is WME capable */
2742                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2743                     (params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)) &&
2744                     info->attrs[NL80211_ATTR_STA_WME]) {
2745                         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
2746                         struct nlattr *nla;
2747
2748                         nla = info->attrs[NL80211_ATTR_STA_WME];
2749                         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
2750                                                nl80211_sta_wme_policy);
2751                         if (err)
2752                                 return err;
2753
2754                         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
2755                                 params.uapsd_queues =
2756                                      nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]);
2757                         if (params.uapsd_queues &
2758                                         ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
2759                                 return -EINVAL;
2760
2761                         if (tb[NL80211_STA_WME_MAX_SP])
2762                                 params.max_sp =
2763                                      nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
2764
2765                         if (params.max_sp &
2766                                         ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
2767                                 return -EINVAL;
2768
2769                         params.sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
2770                 }
2771                 /* TDLS peers cannot be added */
2772                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
2773                         return -EINVAL;
2774                 /* but don't bother the driver with it */
2775                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
2776
2777                 /* must be last in here for error handling */
2778                 params.vlan = get_vlan(info, rdev);
2779                 if (IS_ERR(params.vlan))
2780                         return PTR_ERR(params.vlan);
2781                 break;
2782         case NL80211_IFTYPE_MESH_POINT:
2783                 /* TDLS peers cannot be added */
2784                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
2785                         return -EINVAL;
2786                 break;
2787         case NL80211_IFTYPE_STATION:
2788                 /* Only TDLS peers can be added */
2789                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
2790                         return -EINVAL;
2791                 /* Can only add if TDLS ... */
2792                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
2793                         return -EOPNOTSUPP;
2794                 /* ... with external setup is supported */
2795                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
2796                         return -EOPNOTSUPP;
2797                 break;
2798         default:
2799                 return -EOPNOTSUPP;
2800         }
2801
2802         /* be aware of params.vlan when changing code here */
2803
2804         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2805
2806         if (params.vlan)
2807                 dev_put(params.vlan);
2808         return err;
2809 }
2810
2811 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2812 {
2813         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2814         struct net_device *dev = info->user_ptr[1];
2815         u8 *mac_addr = NULL;
2816
2817         if (info->attrs[NL80211_ATTR_MAC])
2818                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2819
2820         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2821             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2822             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2823             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2824                 return -EINVAL;
2825
2826         if (!rdev->ops->del_station)
2827                 return -EOPNOTSUPP;
2828
2829         return rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2830 }
2831
2832 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2833                                 int flags, struct net_device *dev,
2834                                 u8 *dst, u8 *next_hop,
2835                                 struct mpath_info *pinfo)
2836 {
2837         void *hdr;
2838         struct nlattr *pinfoattr;
2839
2840         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2841         if (!hdr)
2842                 return -1;
2843
2844         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2845         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2846         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2847
2848         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2849
2850         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2851         if (!pinfoattr)
2852                 goto nla_put_failure;
2853         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2854                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2855                             pinfo->frame_qlen);
2856         if (pinfo->filled & MPATH_INFO_SN)
2857                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2858                             pinfo->sn);
2859         if (pinfo->filled & MPATH_INFO_METRIC)
2860                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2861                             pinfo->metric);
2862         if (pinfo->filled & MPATH_INFO_EXPTIME)
2863                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2864                             pinfo->exptime);
2865         if (pinfo->filled & MPATH_INFO_FLAGS)
2866                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2867                             pinfo->flags);
2868         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2869                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2870                             pinfo->discovery_timeout);
2871         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2872                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2873                             pinfo->discovery_retries);
2874
2875         nla_nest_end(msg, pinfoattr);
2876
2877         return genlmsg_end(msg, hdr);
2878
2879  nla_put_failure:
2880         genlmsg_cancel(msg, hdr);
2881         return -EMSGSIZE;
2882 }
2883
2884 static int nl80211_dump_mpath(struct sk_buff *skb,
2885                               struct netlink_callback *cb)
2886 {
2887         struct mpath_info pinfo;
2888         struct cfg80211_registered_device *dev;
2889         struct net_device *netdev;
2890         u8 dst[ETH_ALEN];
2891         u8 next_hop[ETH_ALEN];
2892         int path_idx = cb->args[1];
2893         int err;
2894
2895         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2896         if (err)
2897                 return err;
2898
2899         if (!dev->ops->dump_mpath) {
2900                 err = -EOPNOTSUPP;
2901                 goto out_err;
2902         }
2903
2904         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2905                 err = -EOPNOTSUPP;
2906                 goto out_err;
2907         }
2908
2909         while (1) {
2910                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2911                                            dst, next_hop, &pinfo);
2912                 if (err == -ENOENT)
2913                         break;
2914                 if (err)
2915                         goto out_err;
2916
2917                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2918                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2919                                        netdev, dst, next_hop,
2920                                        &pinfo) < 0)
2921                         goto out;
2922
2923                 path_idx++;
2924         }
2925
2926
2927  out:
2928         cb->args[1] = path_idx;
2929         err = skb->len;
2930  out_err:
2931         nl80211_finish_netdev_dump(dev);
2932         return err;
2933 }
2934
2935 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2936 {
2937         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2938         int err;
2939         struct net_device *dev = info->user_ptr[1];
2940         struct mpath_info pinfo;
2941         struct sk_buff *msg;
2942         u8 *dst = NULL;
2943         u8 next_hop[ETH_ALEN];
2944
2945         memset(&pinfo, 0, sizeof(pinfo));
2946
2947         if (!info->attrs[NL80211_ATTR_MAC])
2948                 return -EINVAL;
2949
2950         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2951
2952         if (!rdev->ops->get_mpath)
2953                 return -EOPNOTSUPP;
2954
2955         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2956                 return -EOPNOTSUPP;
2957
2958         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2959         if (err)
2960                 return err;
2961
2962         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2963         if (!msg)
2964                 return -ENOMEM;
2965
2966         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2967                                  dev, dst, next_hop, &pinfo) < 0) {
2968                 nlmsg_free(msg);
2969                 return -ENOBUFS;
2970         }
2971
2972         return genlmsg_reply(msg, info);
2973 }
2974
2975 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2976 {
2977         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2978         struct net_device *dev = info->user_ptr[1];
2979         u8 *dst = NULL;
2980         u8 *next_hop = NULL;
2981
2982         if (!info->attrs[NL80211_ATTR_MAC])
2983                 return -EINVAL;
2984
2985         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2986                 return -EINVAL;
2987
2988         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2989         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2990
2991         if (!rdev->ops->change_mpath)
2992                 return -EOPNOTSUPP;
2993
2994         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2995                 return -EOPNOTSUPP;
2996
2997         return rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2998 }
2999
3000 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
3001 {
3002         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3003         struct net_device *dev = info->user_ptr[1];
3004         u8 *dst = NULL;
3005         u8 *next_hop = NULL;
3006
3007         if (!info->attrs[NL80211_ATTR_MAC])
3008                 return -EINVAL;
3009
3010         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3011                 return -EINVAL;
3012
3013         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3014         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3015
3016         if (!rdev->ops->add_mpath)
3017                 return -EOPNOTSUPP;
3018
3019         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3020                 return -EOPNOTSUPP;
3021
3022         return rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
3023 }
3024
3025 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
3026 {
3027         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3028         struct net_device *dev = info->user_ptr[1];
3029         u8 *dst = NULL;
3030
3031         if (info->attrs[NL80211_ATTR_MAC])
3032                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3033
3034         if (!rdev->ops->del_mpath)
3035                 return -EOPNOTSUPP;
3036
3037         return rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
3038 }
3039
3040 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
3041 {
3042         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3043         struct net_device *dev = info->user_ptr[1];
3044         struct bss_parameters params;
3045
3046         memset(&params, 0, sizeof(params));
3047         /* default to not changing parameters */
3048         params.use_cts_prot = -1;
3049         params.use_short_preamble = -1;
3050         params.use_short_slot_time = -1;
3051         params.ap_isolate = -1;
3052         params.ht_opmode = -1;
3053
3054         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
3055                 params.use_cts_prot =
3056                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
3057         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
3058                 params.use_short_preamble =
3059                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
3060         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
3061                 params.use_short_slot_time =
3062                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
3063         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
3064                 params.basic_rates =
3065                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3066                 params.basic_rates_len =
3067                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3068         }
3069         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
3070                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
3071         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
3072                 params.ht_opmode =
3073                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
3074
3075         if (!rdev->ops->change_bss)
3076                 return -EOPNOTSUPP;
3077
3078         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3079             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3080                 return -EOPNOTSUPP;
3081
3082         return rdev->ops->change_bss(&rdev->wiphy, dev, &params);
3083 }
3084
3085 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
3086         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
3087         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
3088         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
3089         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
3090         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
3091         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
3092 };
3093
3094 static int parse_reg_rule(struct nlattr *tb[],
3095         struct ieee80211_reg_rule *reg_rule)
3096 {
3097         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
3098         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
3099
3100         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
3101                 return -EINVAL;
3102         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
3103                 return -EINVAL;
3104         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
3105                 return -EINVAL;
3106         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
3107                 return -EINVAL;
3108         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
3109                 return -EINVAL;
3110
3111         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
3112
3113         freq_range->start_freq_khz =
3114                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
3115         freq_range->end_freq_khz =
3116                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
3117         freq_range->max_bandwidth_khz =
3118                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
3119
3120         power_rule->max_eirp =
3121                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
3122
3123         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
3124                 power_rule->max_antenna_gain =
3125                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
3126
3127         return 0;
3128 }
3129
3130 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
3131 {
3132         int r;
3133         char *data = NULL;
3134
3135         /*
3136          * You should only get this when cfg80211 hasn't yet initialized
3137          * completely when built-in to the kernel right between the time
3138          * window between nl80211_init() and regulatory_init(), if that is
3139          * even possible.
3140          */
3141         mutex_lock(&cfg80211_mutex);
3142         if (unlikely(!cfg80211_regdomain)) {
3143                 mutex_unlock(&cfg80211_mutex);
3144                 return -EINPROGRESS;
3145         }
3146         mutex_unlock(&cfg80211_mutex);
3147
3148         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3149                 return -EINVAL;
3150
3151         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3152
3153         r = regulatory_hint_user(data);
3154
3155         return r;
3156 }
3157
3158 static int nl80211_get_mesh_config(struct sk_buff *skb,
3159                                    struct genl_info *info)
3160 {
3161         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3162         struct net_device *dev = info->user_ptr[1];
3163         struct wireless_dev *wdev = dev->ieee80211_ptr;
3164         struct mesh_config cur_params;
3165         int err = 0;
3166         void *hdr;
3167         struct nlattr *pinfoattr;
3168         struct sk_buff *msg;
3169
3170         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3171                 return -EOPNOTSUPP;
3172
3173         if (!rdev->ops->get_mesh_config)
3174                 return -EOPNOTSUPP;
3175
3176         wdev_lock(wdev);
3177         /* If not connected, get default parameters */
3178         if (!wdev->mesh_id_len)
3179                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
3180         else
3181                 err = rdev->ops->get_mesh_config(&rdev->wiphy, dev,
3182                                                  &cur_params);
3183         wdev_unlock(wdev);
3184
3185         if (err)
3186                 return err;
3187
3188         /* Draw up a netlink message to send back */
3189         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3190         if (!msg)
3191                 return -ENOMEM;
3192         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3193                              NL80211_CMD_GET_MESH_CONFIG);
3194         if (!hdr)
3195                 goto out;
3196         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
3197         if (!pinfoattr)
3198                 goto nla_put_failure;
3199         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3200         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
3201                         cur_params.dot11MeshRetryTimeout);
3202         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3203                         cur_params.dot11MeshConfirmTimeout);
3204         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
3205                         cur_params.dot11MeshHoldingTimeout);
3206         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
3207                         cur_params.dot11MeshMaxPeerLinks);
3208         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
3209                         cur_params.dot11MeshMaxRetries);
3210         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
3211                         cur_params.dot11MeshTTL);
3212         NLA_PUT_U8(msg, NL80211_MESHCONF_ELEMENT_TTL,
3213                         cur_params.element_ttl);
3214         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3215                         cur_params.auto_open_plinks);
3216         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3217                         cur_params.dot11MeshHWMPmaxPREQretries);
3218         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
3219                         cur_params.path_refresh_time);
3220         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3221                         cur_params.min_discovery_timeout);
3222         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3223                         cur_params.dot11MeshHWMPactivePathTimeout);
3224         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3225                         cur_params.dot11MeshHWMPpreqMinInterval);
3226         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
3227                         cur_params.dot11MeshHWMPperrMinInterval);
3228         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3229                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
3230         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
3231                         cur_params.dot11MeshHWMPRootMode);
3232         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3233                         cur_params.dot11MeshHWMPRannInterval);
3234         NLA_PUT_U8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3235                         cur_params.dot11MeshGateAnnouncementProtocol);
3236         nla_nest_end(msg, pinfoattr);
3237         genlmsg_end(msg, hdr);
3238         return genlmsg_reply(msg, info);
3239
3240  nla_put_failure:
3241         genlmsg_cancel(msg, hdr);
3242  out:
3243         nlmsg_free(msg);
3244         return -ENOBUFS;
3245 }
3246
3247 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
3248         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
3249         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
3250         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
3251         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
3252         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
3253         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
3254         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
3255         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
3256
3257         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
3258         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
3259         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
3260         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
3261         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
3262         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
3263         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
3264         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
3265         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
3266         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
3267 };
3268
3269 static const struct nla_policy
3270         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
3271         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
3272         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
3273         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
3274         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
3275                 .len = IEEE80211_MAX_DATA_LEN },
3276         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
3277 };
3278
3279 static int nl80211_parse_mesh_config(struct genl_info *info,
3280                                      struct mesh_config *cfg,
3281                                      u32 *mask_out)
3282 {
3283         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
3284         u32 mask = 0;
3285
3286 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
3287 do {\
3288         if (table[attr_num]) {\
3289                 cfg->param = nla_fn(table[attr_num]); \
3290                 mask |= (1 << (attr_num - 1)); \
3291         } \
3292 } while (0);\
3293
3294
3295         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
3296                 return -EINVAL;
3297         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
3298                              info->attrs[NL80211_ATTR_MESH_CONFIG],
3299                              nl80211_meshconf_params_policy))
3300                 return -EINVAL;
3301
3302         /* This makes sure that there aren't more than 32 mesh config
3303          * parameters (otherwise our bitfield scheme would not work.) */
3304         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
3305
3306         /* Fill in the params struct */
3307         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
3308                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
3309         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
3310                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
3311         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
3312                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
3313         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
3314                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
3315         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
3316                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
3317         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
3318                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
3319         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
3320                         mask, NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
3321         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
3322                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
3323         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
3324                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3325                         nla_get_u8);
3326         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
3327                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
3328         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
3329                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3330                         nla_get_u16);
3331         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
3332                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3333                         nla_get_u32);
3334         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
3335                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3336                         nla_get_u16);
3337         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
3338                         mask, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
3339                         nla_get_u16);
3340         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3341                         dot11MeshHWMPnetDiameterTraversalTime,
3342                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3343                         nla_get_u16);
3344         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3345                         dot11MeshHWMPRootMode, mask,
3346                         NL80211_MESHCONF_HWMP_ROOTMODE,
3347                         nla_get_u8);
3348         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3349                         dot11MeshHWMPRannInterval, mask,
3350                         NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3351                         nla_get_u16);
3352         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3353                         dot11MeshGateAnnouncementProtocol, mask,
3354                         NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3355                         nla_get_u8);
3356         if (mask_out)
3357                 *mask_out = mask;
3358
3359         return 0;
3360
3361 #undef FILL_IN_MESH_PARAM_IF_SET
3362 }
3363
3364 static int nl80211_parse_mesh_setup(struct genl_info *info,
3365                                      struct mesh_setup *setup)
3366 {
3367         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
3368
3369         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
3370                 return -EINVAL;
3371         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
3372                              info->attrs[NL80211_ATTR_MESH_SETUP],
3373                              nl80211_mesh_setup_params_policy))
3374                 return -EINVAL;
3375
3376         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
3377                 setup->path_sel_proto =
3378                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
3379                  IEEE80211_PATH_PROTOCOL_VENDOR :
3380                  IEEE80211_PATH_PROTOCOL_HWMP;
3381
3382         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
3383                 setup->path_metric =
3384                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
3385                  IEEE80211_PATH_METRIC_VENDOR :
3386                  IEEE80211_PATH_METRIC_AIRTIME;
3387
3388
3389         if (tb[NL80211_MESH_SETUP_IE]) {
3390                 struct nlattr *ieattr =
3391                         tb[NL80211_MESH_SETUP_IE];
3392                 if (!is_valid_ie_attr(ieattr))
3393                         return -EINVAL;
3394                 setup->ie = nla_data(ieattr);
3395                 setup->ie_len = nla_len(ieattr);
3396         }
3397         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
3398         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
3399
3400         return 0;
3401 }
3402
3403 static int nl80211_update_mesh_config(struct sk_buff *skb,
3404                                       struct genl_info *info)
3405 {
3406         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3407         struct net_device *dev = info->user_ptr[1];
3408         struct wireless_dev *wdev = dev->ieee80211_ptr;
3409         struct mesh_config cfg;
3410         u32 mask;
3411         int err;
3412
3413         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3414                 return -EOPNOTSUPP;
3415
3416         if (!rdev->ops->update_mesh_config)
3417                 return -EOPNOTSUPP;
3418
3419         err = nl80211_parse_mesh_config(info, &cfg, &mask);
3420         if (err)
3421                 return err;
3422
3423         wdev_lock(wdev);
3424         if (!wdev->mesh_id_len)
3425                 err = -ENOLINK;
3426
3427         if (!err)
3428                 err = rdev->ops->update_mesh_config(&rdev->wiphy, dev,
3429                                                     mask, &cfg);
3430
3431         wdev_unlock(wdev);
3432
3433         return err;
3434 }
3435
3436 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
3437 {
3438         struct sk_buff *msg;
3439         void *hdr = NULL;
3440         struct nlattr *nl_reg_rules;
3441         unsigned int i;
3442         int err = -EINVAL;
3443
3444         mutex_lock(&cfg80211_mutex);
3445
3446         if (!cfg80211_regdomain)
3447                 goto out;
3448
3449         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3450         if (!msg) {
3451                 err = -ENOBUFS;
3452                 goto out;
3453         }
3454
3455         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3456                              NL80211_CMD_GET_REG);
3457         if (!hdr)
3458                 goto put_failure;
3459
3460         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
3461                 cfg80211_regdomain->alpha2);
3462         if (cfg80211_regdomain->dfs_region)
3463                 NLA_PUT_U8(msg, NL80211_ATTR_DFS_REGION,
3464                            cfg80211_regdomain->dfs_region);
3465
3466         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
3467         if (!nl_reg_rules)
3468                 goto nla_put_failure;
3469
3470         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
3471                 struct nlattr *nl_reg_rule;
3472                 const struct ieee80211_reg_rule *reg_rule;
3473                 const struct ieee80211_freq_range *freq_range;
3474                 const struct ieee80211_power_rule *power_rule;
3475
3476                 reg_rule = &cfg80211_regdomain->reg_rules[i];
3477                 freq_range = &reg_rule->freq_range;
3478                 power_rule = &reg_rule->power_rule;
3479
3480                 nl_reg_rule = nla_nest_start(msg, i);
3481                 if (!nl_reg_rule)
3482                         goto nla_put_failure;
3483
3484                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
3485                         reg_rule->flags);
3486                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
3487                         freq_range->start_freq_khz);
3488                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
3489                         freq_range->end_freq_khz);
3490                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
3491                         freq_range->max_bandwidth_khz);
3492                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
3493                         power_rule->max_antenna_gain);
3494                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
3495                         power_rule->max_eirp);
3496
3497                 nla_nest_end(msg, nl_reg_rule);
3498         }
3499
3500         nla_nest_end(msg, nl_reg_rules);
3501
3502         genlmsg_end(msg, hdr);
3503         err = genlmsg_reply(msg, info);
3504         goto out;
3505
3506 nla_put_failure:
3507         genlmsg_cancel(msg, hdr);
3508 put_failure:
3509         nlmsg_free(msg);
3510         err = -EMSGSIZE;
3511 out:
3512         mutex_unlock(&cfg80211_mutex);
3513         return err;
3514 }
3515
3516 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
3517 {
3518         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
3519         struct nlattr *nl_reg_rule;
3520         char *alpha2 = NULL;
3521         int rem_reg_rules = 0, r = 0;
3522         u32 num_rules = 0, rule_idx = 0, size_of_regd;
3523         u8 dfs_region = 0;
3524         struct ieee80211_regdomain *rd = NULL;
3525
3526         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3527                 return -EINVAL;
3528
3529         if (!info->attrs[NL80211_ATTR_REG_RULES])
3530                 return -EINVAL;
3531
3532         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3533
3534         if (info->attrs[NL80211_ATTR_DFS_REGION])
3535                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
3536
3537         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3538                         rem_reg_rules) {
3539                 num_rules++;
3540                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
3541                         return -EINVAL;
3542         }
3543
3544         mutex_lock(&cfg80211_mutex);
3545
3546         if (!reg_is_valid_request(alpha2)) {
3547                 r = -EINVAL;
3548                 goto bad_reg;
3549         }
3550
3551         size_of_regd = sizeof(struct ieee80211_regdomain) +
3552                 (num_rules * sizeof(struct ieee80211_reg_rule));
3553
3554         rd = kzalloc(size_of_regd, GFP_KERNEL);
3555         if (!rd) {
3556                 r = -ENOMEM;
3557                 goto bad_reg;
3558         }
3559
3560         rd->n_reg_rules = num_rules;
3561         rd->alpha2[0] = alpha2[0];
3562         rd->alpha2[1] = alpha2[1];
3563
3564         /*
3565          * Disable DFS master mode if the DFS region was
3566          * not supported or known on this kernel.
3567          */
3568         if (reg_supported_dfs_region(dfs_region))
3569                 rd->dfs_region = dfs_region;
3570
3571         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3572                         rem_reg_rules) {
3573                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
3574                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
3575                         reg_rule_policy);
3576                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
3577                 if (r)
3578                         goto bad_reg;
3579
3580                 rule_idx++;
3581
3582                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
3583                         r = -EINVAL;
3584                         goto bad_reg;
3585                 }
3586         }
3587
3588         BUG_ON(rule_idx != num_rules);
3589
3590         r = set_regdom(rd);
3591
3592         mutex_unlock(&cfg80211_mutex);
3593
3594         return r;
3595
3596  bad_reg:
3597         mutex_unlock(&cfg80211_mutex);
3598         kfree(rd);
3599         return r;
3600 }
3601
3602 static int validate_scan_freqs(struct nlattr *freqs)
3603 {
3604         struct nlattr *attr1, *attr2;
3605         int n_channels = 0, tmp1, tmp2;
3606
3607         nla_for_each_nested(attr1, freqs, tmp1) {
3608                 n_channels++;
3609                 /*
3610                  * Some hardware has a limited channel list for
3611                  * scanning, and it is pretty much nonsensical
3612                  * to scan for a channel twice, so disallow that
3613                  * and don't require drivers to check that the
3614                  * channel list they get isn't longer than what
3615                  * they can scan, as long as they can scan all
3616                  * the channels they registered at once.
3617                  */
3618                 nla_for_each_nested(attr2, freqs, tmp2)
3619                         if (attr1 != attr2 &&
3620                             nla_get_u32(attr1) == nla_get_u32(attr2))
3621                                 return 0;
3622         }
3623
3624         return n_channels;
3625 }
3626
3627 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
3628 {
3629         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3630         struct net_device *dev = info->user_ptr[1];
3631         struct cfg80211_scan_request *request;
3632         struct nlattr *attr;
3633         struct wiphy *wiphy;
3634         int err, tmp, n_ssids = 0, n_channels, i;
3635         size_t ie_len;
3636
3637         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3638                 return -EINVAL;
3639
3640         wiphy = &rdev->wiphy;
3641
3642         if (!rdev->ops->scan)
3643                 return -EOPNOTSUPP;
3644
3645         if (rdev->scan_req)
3646                 return -EBUSY;
3647
3648         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3649                 n_channels = validate_scan_freqs(
3650                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3651                 if (!n_channels)
3652                         return -EINVAL;
3653         } else {
3654                 enum ieee80211_band band;
3655                 n_channels = 0;
3656
3657                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3658                         if (wiphy->bands[band])
3659                                 n_channels += wiphy->bands[band]->n_channels;
3660         }
3661
3662         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3663                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
3664                         n_ssids++;
3665
3666         if (n_ssids > wiphy->max_scan_ssids)
3667                 return -EINVAL;
3668
3669         if (info->attrs[NL80211_ATTR_IE])
3670                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3671         else
3672                 ie_len = 0;
3673
3674         if (ie_len > wiphy->max_scan_ie_len)
3675                 return -EINVAL;
3676
3677         request = kzalloc(sizeof(*request)
3678                         + sizeof(*request->ssids) * n_ssids
3679                         + sizeof(*request->channels) * n_channels
3680                         + ie_len, GFP_KERNEL);
3681         if (!request)
3682                 return -ENOMEM;
3683
3684         if (n_ssids)
3685                 request->ssids = (void *)&request->channels[n_channels];
3686         request->n_ssids = n_ssids;
3687         if (ie_len) {
3688                 if (request->ssids)
3689                         request->ie = (void *)(request->ssids + n_ssids);
3690                 else
3691                         request->ie = (void *)(request->channels + n_channels);
3692         }
3693
3694         i = 0;
3695         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3696                 /* user specified, bail out if channel not found */
3697                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3698                         struct ieee80211_channel *chan;
3699
3700                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3701
3702                         if (!chan) {
3703                                 err = -EINVAL;
3704                                 goto out_free;
3705                         }
3706
3707                         /* ignore disabled channels */
3708                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3709                                 continue;
3710
3711                         request->channels[i] = chan;
3712                         i++;
3713                 }
3714         } else {
3715                 enum ieee80211_band band;
3716
3717                 /* all channels */
3718                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3719                         int j;
3720                         if (!wiphy->bands[band])
3721                                 continue;
3722                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3723                                 struct ieee80211_channel *chan;
3724
3725                                 chan = &wiphy->bands[band]->channels[j];
3726
3727                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3728                                         continue;
3729
3730                                 request->channels[i] = chan;
3731                                 i++;
3732                         }
3733                 }
3734         }
3735
3736         if (!i) {
3737                 err = -EINVAL;
3738                 goto out_free;
3739         }
3740
3741         request->n_channels = i;
3742
3743         i = 0;
3744         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3745                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3746                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
3747                                 err = -EINVAL;
3748                                 goto out_free;
3749                         }
3750                         request->ssids[i].ssid_len = nla_len(attr);
3751                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3752                         i++;
3753                 }
3754         }
3755
3756         if (info->attrs[NL80211_ATTR_IE]) {
3757                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3758                 memcpy((void *)request->ie,
3759                        nla_data(info->attrs[NL80211_ATTR_IE]),
3760                        request->ie_len);
3761         }
3762
3763         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
3764                 if (wiphy->bands[i])
3765                         request->rates[i] =
3766                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
3767
3768         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
3769                 nla_for_each_nested(attr,
3770                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
3771                                     tmp) {
3772                         enum ieee80211_band band = nla_type(attr);
3773
3774                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
3775                                 err = -EINVAL;
3776                                 goto out_free;
3777                         }
3778                         err = ieee80211_get_ratemask(wiphy->bands[band],
3779                                                      nla_data(attr),
3780                                                      nla_len(attr),
3781                                                      &request->rates[band]);
3782                         if (err)
3783                                 goto out_free;
3784                 }
3785         }
3786
3787         request->no_cck =
3788                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
3789
3790         request->dev = dev;
3791         request->wiphy = &rdev->wiphy;
3792
3793         rdev->scan_req = request;
3794         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3795
3796         if (!err) {
3797                 nl80211_send_scan_start(rdev, dev);
3798                 dev_hold(dev);
3799         } else {
3800  out_free:
3801                 rdev->scan_req = NULL;
3802                 kfree(request);
3803         }
3804
3805         return err;
3806 }
3807
3808 static int nl80211_start_sched_scan(struct sk_buff *skb,
3809                                     struct genl_info *info)
3810 {
3811         struct cfg80211_sched_scan_request *request;
3812         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3813         struct net_device *dev = info->user_ptr[1];
3814         struct nlattr *attr;
3815         struct wiphy *wiphy;
3816         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
3817         u32 interval;
3818         enum ieee80211_band band;
3819         size_t ie_len;
3820         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
3821
3822         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
3823             !rdev->ops->sched_scan_start)
3824                 return -EOPNOTSUPP;
3825
3826         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3827                 return -EINVAL;
3828
3829         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
3830                 return -EINVAL;
3831
3832         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
3833         if (interval == 0)
3834                 return -EINVAL;
3835
3836         wiphy = &rdev->wiphy;
3837
3838         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3839                 n_channels = validate_scan_freqs(
3840                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3841                 if (!n_channels)
3842                         return -EINVAL;
3843         } else {
3844                 n_channels = 0;
3845
3846                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3847                         if (wiphy->bands[band])
3848                                 n_channels += wiphy->bands[band]->n_channels;
3849         }
3850
3851         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3852                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
3853                                     tmp)
3854                         n_ssids++;
3855
3856         if (n_ssids > wiphy->max_sched_scan_ssids)
3857                 return -EINVAL;
3858
3859         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
3860                 nla_for_each_nested(attr,
3861                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
3862                                     tmp)
3863                         n_match_sets++;
3864
3865         if (n_match_sets > wiphy->max_match_sets)
3866                 return -EINVAL;
3867
3868         if (info->attrs[NL80211_ATTR_IE])
3869                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3870         else
3871                 ie_len = 0;
3872
3873         if (ie_len > wiphy->max_sched_scan_ie_len)
3874                 return -EINVAL;
3875
3876         mutex_lock(&rdev->sched_scan_mtx);
3877
3878         if (rdev->sched_scan_req) {
3879                 err = -EINPROGRESS;
3880                 goto out;
3881         }
3882
3883         request = kzalloc(sizeof(*request)
3884                         + sizeof(*request->ssids) * n_ssids
3885                         + sizeof(*request->match_sets) * n_match_sets
3886                         + sizeof(*request->channels) * n_channels
3887                         + ie_len, GFP_KERNEL);
3888         if (!request) {
3889                 err = -ENOMEM;
3890                 goto out;
3891         }
3892
3893         if (n_ssids)
3894                 request->ssids = (void *)&request->channels[n_channels];
3895         request->n_ssids = n_ssids;
3896         if (ie_len) {
3897                 if (request->ssids)
3898                         request->ie = (void *)(request->ssids + n_ssids);
3899                 else
3900                         request->ie = (void *)(request->channels + n_channels);
3901         }
3902
3903         if (n_match_sets) {
3904                 if (request->ie)
3905                         request->match_sets = (void *)(request->ie + ie_len);
3906                 else if (request->ssids)
3907                         request->match_sets =
3908                                 (void *)(request->ssids + n_ssids);
3909                 else
3910                         request->match_sets =
3911                                 (void *)(request->channels + n_channels);
3912         }
3913         request->n_match_sets = n_match_sets;
3914
3915         i = 0;
3916         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3917                 /* user specified, bail out if channel not found */
3918                 nla_for_each_nested(attr,
3919                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
3920                                     tmp) {
3921                         struct ieee80211_channel *chan;
3922
3923                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3924
3925                         if (!chan) {
3926                                 err = -EINVAL;
3927                                 goto out_free;
3928                         }
3929
3930                         /* ignore disabled channels */
3931                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3932                                 continue;
3933
3934                         request->channels[i] = chan;
3935                         i++;
3936                 }
3937         } else {
3938                 /* all channels */
3939                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3940                         int j;
3941                         if (!wiphy->bands[band])
3942                                 continue;
3943                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3944                                 struct ieee80211_channel *chan;
3945
3946                                 chan = &wiphy->bands[band]->channels[j];
3947
3948                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3949                                         continue;
3950
3951                                 request->channels[i] = chan;
3952                                 i++;
3953                         }
3954                 }
3955         }
3956
3957         if (!i) {
3958                 err = -EINVAL;
3959                 goto out_free;
3960         }
3961
3962         request->n_channels = i;
3963
3964         i = 0;
3965         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3966                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
3967                                     tmp) {
3968                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
3969                                 err = -EINVAL;
3970                                 goto out_free;
3971                         }
3972                         request->ssids[i].ssid_len = nla_len(attr);
3973                         memcpy(request->ssids[i].ssid, nla_data(attr),
3974                                nla_len(attr));
3975                         i++;
3976                 }
3977         }
3978
3979         i = 0;
3980         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
3981                 nla_for_each_nested(attr,
3982                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
3983                                     tmp) {
3984                         struct nlattr *ssid;
3985
3986                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
3987                                   nla_data(attr), nla_len(attr),
3988                                   nl80211_match_policy);
3989                         ssid = tb[NL80211_ATTR_SCHED_SCAN_MATCH_SSID];
3990                         if (ssid) {
3991                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
3992                                         err = -EINVAL;
3993                                         goto out_free;
3994                                 }
3995                                 memcpy(request->match_sets[i].ssid.ssid,
3996                                        nla_data(ssid), nla_len(ssid));
3997                                 request->match_sets[i].ssid.ssid_len =
3998                                         nla_len(ssid);
3999                         }
4000                         i++;
4001                 }
4002         }
4003
4004         if (info->attrs[NL80211_ATTR_IE]) {
4005                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4006                 memcpy((void *)request->ie,
4007                        nla_data(info->attrs[NL80211_ATTR_IE]),
4008                        request->ie_len);
4009         }
4010
4011         request->dev = dev;
4012         request->wiphy = &rdev->wiphy;
4013         request->interval = interval;
4014
4015         err = rdev->ops->sched_scan_start(&rdev->wiphy, dev, request);
4016         if (!err) {
4017                 rdev->sched_scan_req = request;
4018                 nl80211_send_sched_scan(rdev, dev,
4019                                         NL80211_CMD_START_SCHED_SCAN);
4020                 goto out;
4021         }
4022
4023 out_free:
4024         kfree(request);
4025 out:
4026         mutex_unlock(&rdev->sched_scan_mtx);
4027         return err;
4028 }
4029
4030 static int nl80211_stop_sched_scan(struct sk_buff *skb,
4031                                    struct genl_info *info)
4032 {
4033         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4034         int err;
4035
4036         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
4037             !rdev->ops->sched_scan_stop)
4038                 return -EOPNOTSUPP;
4039
4040         mutex_lock(&rdev->sched_scan_mtx);
4041         err = __cfg80211_stop_sched_scan(rdev, false);
4042         mutex_unlock(&rdev->sched_scan_mtx);
4043
4044         return err;
4045 }
4046
4047 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
4048                             u32 seq, int flags,
4049                             struct cfg80211_registered_device *rdev,
4050                             struct wireless_dev *wdev,
4051                             struct cfg80211_internal_bss *intbss)
4052 {
4053         struct cfg80211_bss *res = &intbss->pub;
4054         void *hdr;
4055         struct nlattr *bss;
4056         int i;
4057
4058         ASSERT_WDEV_LOCK(wdev);
4059
4060         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).pid, seq, flags,
4061                              NL80211_CMD_NEW_SCAN_RESULTS);
4062         if (!hdr)
4063                 return -1;
4064
4065         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
4066
4067         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
4068         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
4069
4070         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
4071         if (!bss)
4072                 goto nla_put_failure;
4073         if (!is_zero_ether_addr(res->bssid))
4074                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
4075         if (res->information_elements && res->len_information_elements)
4076                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
4077                         res->len_information_elements,
4078                         res->information_elements);
4079         if (res->beacon_ies && res->len_beacon_ies &&
4080             res->beacon_ies != res->information_elements)
4081                 NLA_PUT(msg, NL80211_BSS_BEACON_IES,
4082                         res->len_beacon_ies, res->beacon_ies);
4083         if (res->tsf)
4084                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
4085         if (res->beacon_interval)
4086                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
4087         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
4088         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
4089         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
4090                 jiffies_to_msecs(jiffies - intbss->ts));
4091
4092         switch (rdev->wiphy.signal_type) {
4093         case CFG80211_SIGNAL_TYPE_MBM:
4094                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
4095                 break;
4096         case CFG80211_SIGNAL_TYPE_UNSPEC:
4097                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
4098                 break;
4099         default:
4100                 break;
4101         }
4102
4103         switch (wdev->iftype) {
4104         case NL80211_IFTYPE_P2P_CLIENT:
4105         case NL80211_IFTYPE_STATION:
4106                 if (intbss == wdev->current_bss)
4107                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
4108                                     NL80211_BSS_STATUS_ASSOCIATED);
4109                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
4110                         if (intbss != wdev->auth_bsses[i])
4111                                 continue;
4112                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
4113                                     NL80211_BSS_STATUS_AUTHENTICATED);
4114                         break;
4115                 }
4116                 break;
4117         case NL80211_IFTYPE_ADHOC:
4118                 if (intbss == wdev->current_bss)
4119                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
4120                                     NL80211_BSS_STATUS_IBSS_JOINED);
4121                 break;
4122         default:
4123                 break;
4124         }
4125
4126         nla_nest_end(msg, bss);
4127
4128         return genlmsg_end(msg, hdr);
4129
4130  nla_put_failure:
4131         genlmsg_cancel(msg, hdr);
4132         return -EMSGSIZE;
4133 }
4134
4135 static int nl80211_dump_scan(struct sk_buff *skb,
4136                              struct netlink_callback *cb)
4137 {
4138         struct cfg80211_registered_device *rdev;
4139         struct net_device *dev;
4140         struct cfg80211_internal_bss *scan;
4141         struct wireless_dev *wdev;
4142         int start = cb->args[1], idx = 0;
4143         int err;
4144
4145         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
4146         if (err)
4147                 return err;
4148
4149         wdev = dev->ieee80211_ptr;
4150
4151         wdev_lock(wdev);
4152         spin_lock_bh(&rdev->bss_lock);
4153         cfg80211_bss_expire(rdev);
4154
4155         cb->seq = rdev->bss_generation;
4156
4157         list_for_each_entry(scan, &rdev->bss_list, list) {
4158                 if (++idx <= start)
4159                         continue;
4160                 if (nl80211_send_bss(skb, cb,
4161                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4162                                 rdev, wdev, scan) < 0) {
4163                         idx--;
4164                         break;
4165                 }
4166         }
4167
4168         spin_unlock_bh(&rdev->bss_lock);
4169         wdev_unlock(wdev);
4170
4171         cb->args[1] = idx;
4172         nl80211_finish_netdev_dump(rdev);
4173
4174         return skb->len;
4175 }
4176
4177 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
4178                                 int flags, struct net_device *dev,
4179                                 struct survey_info *survey)
4180 {
4181         void *hdr;
4182         struct nlattr *infoattr;
4183
4184         hdr = nl80211hdr_put(msg, pid, seq, flags,
4185                              NL80211_CMD_NEW_SURVEY_RESULTS);
4186         if (!hdr)
4187                 return -ENOMEM;
4188
4189         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
4190
4191         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
4192         if (!infoattr)
4193                 goto nla_put_failure;
4194
4195         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
4196                     survey->channel->center_freq);
4197         if (survey->filled & SURVEY_INFO_NOISE_DBM)
4198                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
4199                             survey->noise);
4200         if (survey->filled & SURVEY_INFO_IN_USE)
4201                 NLA_PUT_FLAG(msg, NL80211_SURVEY_INFO_IN_USE);
4202         if (survey->filled & SURVEY_INFO_CHANNEL_TIME)
4203                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
4204                             survey->channel_time);
4205         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
4206                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
4207                             survey->channel_time_busy);
4208         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
4209                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
4210                             survey->channel_time_ext_busy);
4211         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_RX)
4212                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
4213                             survey->channel_time_rx);
4214         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_TX)
4215                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
4216                             survey->channel_time_tx);
4217
4218         nla_nest_end(msg, infoattr);
4219
4220         return genlmsg_end(msg, hdr);
4221
4222  nla_put_failure:
4223         genlmsg_cancel(msg, hdr);
4224         return -EMSGSIZE;
4225 }
4226
4227 static int nl80211_dump_survey(struct sk_buff *skb,
4228                         struct netlink_callback *cb)
4229 {
4230         struct survey_info survey;
4231         struct cfg80211_registered_device *dev;
4232         struct net_device *netdev;
4233         int survey_idx = cb->args[1];
4234         int res;
4235
4236         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
4237         if (res)
4238                 return res;
4239
4240         if (!dev->ops->dump_survey) {
4241                 res = -EOPNOTSUPP;
4242                 goto out_err;
4243         }
4244
4245         while (1) {
4246                 struct ieee80211_channel *chan;
4247
4248                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
4249                                             &survey);
4250                 if (res == -ENOENT)
4251                         break;
4252                 if (res)
4253                         goto out_err;
4254
4255                 /* Survey without a channel doesn't make sense */
4256                 if (!survey.channel) {
4257                         res = -EINVAL;
4258                         goto out;
4259                 }
4260
4261                 chan = ieee80211_get_channel(&dev->wiphy,
4262                                              survey.channel->center_freq);
4263                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
4264                         survey_idx++;
4265                         continue;
4266                 }
4267
4268                 if (nl80211_send_survey(skb,
4269                                 NETLINK_CB(cb->skb).pid,
4270                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4271                                 netdev,
4272                                 &survey) < 0)
4273                         goto out;
4274                 survey_idx++;
4275         }
4276
4277  out:
4278         cb->args[1] = survey_idx;
4279         res = skb->len;
4280  out_err:
4281         nl80211_finish_netdev_dump(dev);
4282         return res;
4283 }
4284
4285 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
4286 {
4287         return auth_type <= NL80211_AUTHTYPE_MAX;
4288 }
4289
4290 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
4291 {
4292         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
4293                                   NL80211_WPA_VERSION_2));
4294 }
4295
4296 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
4297 {
4298         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4299         struct net_device *dev = info->user_ptr[1];
4300         struct ieee80211_channel *chan;
4301         const u8 *bssid, *ssid, *ie = NULL;
4302         int err, ssid_len, ie_len = 0;
4303         enum nl80211_auth_type auth_type;
4304         struct key_parse key;
4305         bool local_state_change;
4306
4307         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4308                 return -EINVAL;
4309
4310         if (!info->attrs[NL80211_ATTR_MAC])
4311                 return -EINVAL;
4312
4313         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
4314                 return -EINVAL;
4315
4316         if (!info->attrs[NL80211_ATTR_SSID])
4317                 return -EINVAL;
4318
4319         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
4320                 return -EINVAL;
4321
4322         err = nl80211_parse_key(info, &key);
4323         if (err)
4324                 return err;
4325
4326         if (key.idx >= 0) {
4327                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
4328                         return -EINVAL;
4329                 if (!key.p.key || !key.p.key_len)
4330                         return -EINVAL;
4331                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
4332                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
4333                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
4334                      key.p.key_len != WLAN_KEY_LEN_WEP104))
4335                         return -EINVAL;
4336                 if (key.idx > 4)
4337                         return -EINVAL;
4338         } else {
4339                 key.p.key_len = 0;
4340                 key.p.key = NULL;
4341         }
4342
4343         if (key.idx >= 0) {
4344                 int i;
4345                 bool ok = false;
4346                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
4347                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
4348                                 ok = true;
4349                                 break;
4350                         }
4351                 }
4352                 if (!ok)
4353                         return -EINVAL;
4354         }
4355
4356         if (!rdev->ops->auth)
4357                 return -EOPNOTSUPP;
4358
4359         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4360             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4361                 return -EOPNOTSUPP;
4362
4363         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4364         chan = ieee80211_get_channel(&rdev->wiphy,
4365                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4366         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4367                 return -EINVAL;
4368
4369         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4370         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4371
4372         if (info->attrs[NL80211_ATTR_IE]) {
4373                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4374                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4375         }
4376
4377         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4378         if (!nl80211_valid_auth_type(auth_type))
4379                 return -EINVAL;
4380
4381         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4382
4383         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
4384                                   ssid, ssid_len, ie, ie_len,
4385                                   key.p.key, key.p.key_len, key.idx,
4386                                   local_state_change);
4387 }
4388
4389 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
4390                                    struct genl_info *info,
4391                                    struct cfg80211_crypto_settings *settings,
4392                                    int cipher_limit)
4393 {
4394         memset(settings, 0, sizeof(*settings));
4395
4396         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
4397
4398         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
4399                 u16 proto;
4400                 proto = nla_get_u16(
4401                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
4402                 settings->control_port_ethertype = cpu_to_be16(proto);
4403                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
4404                     proto != ETH_P_PAE)
4405                         return -EINVAL;
4406                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
4407                         settings->control_port_no_encrypt = true;
4408         } else
4409                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
4410
4411         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
4412                 void *data;
4413                 int len, i;
4414
4415                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4416                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4417                 settings->n_ciphers_pairwise = len / sizeof(u32);
4418
4419                 if (len % sizeof(u32))
4420                         return -EINVAL;
4421
4422                 if (settings->n_ciphers_pairwise > cipher_limit)
4423                         return -EINVAL;
4424
4425                 memcpy(settings->ciphers_pairwise, data, len);
4426
4427                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
4428                         if (!cfg80211_supported_cipher_suite(
4429                                         &rdev->wiphy,
4430                                         settings->ciphers_pairwise[i]))
4431                                 return -EINVAL;
4432         }
4433
4434         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
4435                 settings->cipher_group =
4436                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
4437                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
4438                                                      settings->cipher_group))
4439                         return -EINVAL;
4440         }
4441
4442         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
4443                 settings->wpa_versions =
4444                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
4445                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
4446                         return -EINVAL;
4447         }
4448
4449         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
4450                 void *data;
4451                 int len;
4452
4453                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
4454                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
4455                 settings->n_akm_suites = len / sizeof(u32);
4456
4457                 if (len % sizeof(u32))
4458                         return -EINVAL;
4459
4460                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
4461                         return -EINVAL;
4462
4463                 memcpy(settings->akm_suites, data, len);
4464         }
4465
4466         return 0;
4467 }
4468
4469 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
4470 {
4471         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4472         struct net_device *dev = info->user_ptr[1];
4473         struct cfg80211_crypto_settings crypto;
4474         struct ieee80211_channel *chan;
4475         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
4476         int err, ssid_len, ie_len = 0;
4477         bool use_mfp = false;
4478         u32 flags = 0;
4479         struct ieee80211_ht_cap *ht_capa = NULL;
4480         struct ieee80211_ht_cap *ht_capa_mask = NULL;
4481
4482         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4483                 return -EINVAL;
4484
4485         if (!info->attrs[NL80211_ATTR_MAC] ||
4486             !info->attrs[NL80211_ATTR_SSID] ||
4487             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4488                 return -EINVAL;
4489
4490         if (!rdev->ops->assoc)
4491                 return -EOPNOTSUPP;
4492
4493         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4494             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4495                 return -EOPNOTSUPP;
4496
4497         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4498
4499         chan = ieee80211_get_channel(&rdev->wiphy,
4500                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4501         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4502                 return -EINVAL;
4503
4504         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4505         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4506
4507         if (info->attrs[NL80211_ATTR_IE]) {
4508                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4509                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4510         }
4511
4512         if (info->attrs[NL80211_ATTR_USE_MFP]) {
4513                 enum nl80211_mfp mfp =
4514                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
4515                 if (mfp == NL80211_MFP_REQUIRED)
4516                         use_mfp = true;
4517                 else if (mfp != NL80211_MFP_NO)
4518                         return -EINVAL;
4519         }
4520
4521         if (info->attrs[NL80211_ATTR_PREV_BSSID])
4522                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
4523
4524         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
4525                 flags |= ASSOC_REQ_DISABLE_HT;
4526
4527         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
4528                 ht_capa_mask =
4529                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]);
4530
4531         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
4532                 if (!ht_capa_mask)
4533                         return -EINVAL;
4534                 ht_capa = nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4535         }
4536
4537         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
4538         if (!err)
4539                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
4540                                           ssid, ssid_len, ie, ie_len, use_mfp,
4541                                           &crypto, flags, ht_capa,
4542                                           ht_capa_mask);
4543
4544         return err;
4545 }
4546
4547 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
4548 {
4549         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4550         struct net_device *dev = info->user_ptr[1];
4551         const u8 *ie = NULL, *bssid;
4552         int ie_len = 0;
4553         u16 reason_code;
4554         bool local_state_change;
4555
4556         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4557                 return -EINVAL;
4558
4559         if (!info->attrs[NL80211_ATTR_MAC])
4560                 return -EINVAL;
4561
4562         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4563                 return -EINVAL;
4564
4565         if (!rdev->ops->deauth)
4566                 return -EOPNOTSUPP;
4567
4568         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4569             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4570                 return -EOPNOTSUPP;
4571
4572         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4573
4574         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4575         if (reason_code == 0) {
4576                 /* Reason Code 0 is reserved */
4577                 return -EINVAL;
4578         }
4579
4580         if (info->attrs[NL80211_ATTR_IE]) {
4581                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4582                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4583         }
4584
4585         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4586
4587         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
4588                                     local_state_change);
4589 }
4590
4591 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
4592 {
4593         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4594         struct net_device *dev = info->user_ptr[1];
4595         const u8 *ie = NULL, *bssid;
4596         int ie_len = 0;
4597         u16 reason_code;
4598         bool local_state_change;
4599
4600         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4601                 return -EINVAL;
4602
4603         if (!info->attrs[NL80211_ATTR_MAC])
4604                 return -EINVAL;
4605
4606         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4607                 return -EINVAL;
4608
4609         if (!rdev->ops->disassoc)
4610                 return -EOPNOTSUPP;
4611
4612         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4613             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4614                 return -EOPNOTSUPP;
4615
4616         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4617
4618         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4619         if (reason_code == 0) {
4620                 /* Reason Code 0 is reserved */
4621                 return -EINVAL;
4622         }
4623
4624         if (info->attrs[NL80211_ATTR_IE]) {
4625                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4626                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4627         }
4628
4629         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4630
4631         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
4632                                       local_state_change);
4633 }
4634
4635 static bool
4636 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
4637                          int mcast_rate[IEEE80211_NUM_BANDS],
4638                          int rateval)
4639 {
4640         struct wiphy *wiphy = &rdev->wiphy;
4641         bool found = false;
4642         int band, i;
4643
4644         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4645                 struct ieee80211_supported_band *sband;
4646
4647                 sband = wiphy->bands[band];
4648                 if (!sband)
4649                         continue;
4650
4651                 for (i = 0; i < sband->n_bitrates; i++) {
4652                         if (sband->bitrates[i].bitrate == rateval) {
4653                                 mcast_rate[band] = i + 1;
4654                                 found = true;
4655                                 break;
4656                         }
4657                 }
4658         }
4659
4660         return found;
4661 }
4662
4663 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
4664 {
4665         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4666         struct net_device *dev = info->user_ptr[1];
4667         struct cfg80211_ibss_params ibss;
4668         struct wiphy *wiphy;
4669         struct cfg80211_cached_keys *connkeys = NULL;
4670         int err;
4671
4672         memset(&ibss, 0, sizeof(ibss));
4673
4674         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4675                 return -EINVAL;
4676
4677         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4678             !info->attrs[NL80211_ATTR_SSID] ||
4679             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4680                 return -EINVAL;
4681
4682         ibss.beacon_interval = 100;
4683
4684         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
4685                 ibss.beacon_interval =
4686                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4687                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
4688                         return -EINVAL;
4689         }
4690
4691         if (!rdev->ops->join_ibss)
4692                 return -EOPNOTSUPP;
4693
4694         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
4695                 return -EOPNOTSUPP;
4696
4697         wiphy = &rdev->wiphy;
4698
4699         if (info->attrs[NL80211_ATTR_MAC]) {
4700                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4701
4702                 if (!is_valid_ether_addr(ibss.bssid))
4703                         return -EINVAL;
4704         }
4705         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4706         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4707
4708         if (info->attrs[NL80211_ATTR_IE]) {
4709                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4710                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4711         }
4712
4713         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4714                 enum nl80211_channel_type channel_type;
4715
4716                 channel_type = nla_get_u32(
4717                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4718                 if (channel_type != NL80211_CHAN_NO_HT &&
4719                     channel_type != NL80211_CHAN_HT20 &&
4720                     channel_type != NL80211_CHAN_HT40MINUS &&
4721                     channel_type != NL80211_CHAN_HT40PLUS)
4722                         return -EINVAL;
4723
4724                 if (channel_type != NL80211_CHAN_NO_HT &&
4725                     !(wiphy->features & NL80211_FEATURE_HT_IBSS))
4726                         return -EINVAL;
4727
4728                 ibss.channel_type = channel_type;
4729         } else {
4730                 ibss.channel_type = NL80211_CHAN_NO_HT;
4731         }
4732
4733         ibss.channel = rdev_freq_to_chan(rdev,
4734                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
4735                 ibss.channel_type);
4736         if (!ibss.channel ||
4737             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
4738             ibss.channel->flags & IEEE80211_CHAN_DISABLED)
4739                 return -EINVAL;
4740
4741         /* Both channels should be able to initiate communication */
4742         if ((ibss.channel_type == NL80211_CHAN_HT40PLUS ||
4743              ibss.channel_type == NL80211_CHAN_HT40MINUS) &&
4744             !cfg80211_can_beacon_sec_chan(&rdev->wiphy, ibss.channel,
4745                                           ibss.channel_type))
4746                 return -EINVAL;
4747
4748         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
4749         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4750
4751         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4752                 u8 *rates =
4753                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4754                 int n_rates =
4755                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4756                 struct ieee80211_supported_band *sband =
4757                         wiphy->bands[ibss.channel->band];
4758                 int err;
4759
4760                 err = ieee80211_get_ratemask(sband, rates, n_rates,
4761                                              &ibss.basic_rates);
4762                 if (err)
4763                         return err;
4764         }
4765
4766         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
4767             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
4768                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
4769                 return -EINVAL;
4770
4771         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4772                 connkeys = nl80211_parse_connkeys(rdev,
4773                                         info->attrs[NL80211_ATTR_KEYS]);
4774                 if (IS_ERR(connkeys))
4775                         return PTR_ERR(connkeys);
4776         }
4777
4778         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
4779         if (err)
4780                 kfree(connkeys);
4781         return err;
4782 }
4783
4784 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
4785 {
4786         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4787         struct net_device *dev = info->user_ptr[1];
4788
4789         if (!rdev->ops->leave_ibss)
4790                 return -EOPNOTSUPP;
4791
4792         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
4793                 return -EOPNOTSUPP;
4794
4795         return cfg80211_leave_ibss(rdev, dev, false);
4796 }
4797
4798 #ifdef CONFIG_NL80211_TESTMODE
4799 static struct genl_multicast_group nl80211_testmode_mcgrp = {
4800         .name = "testmode",
4801 };
4802
4803 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
4804 {
4805         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4806         int err;
4807
4808         if (!info->attrs[NL80211_ATTR_TESTDATA])
4809                 return -EINVAL;
4810
4811         err = -EOPNOTSUPP;
4812         if (rdev->ops->testmode_cmd) {
4813                 rdev->testmode_info = info;
4814                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
4815                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
4816                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
4817                 rdev->testmode_info = NULL;
4818         }
4819
4820         return err;
4821 }
4822
4823 static int nl80211_testmode_dump(struct sk_buff *skb,
4824                                  struct netlink_callback *cb)
4825 {
4826         struct cfg80211_registered_device *rdev;
4827         int err;
4828         long phy_idx;
4829         void *data = NULL;
4830         int data_len = 0;
4831
4832         if (cb->args[0]) {
4833                 /*
4834                  * 0 is a valid index, but not valid for args[0],
4835                  * so we need to offset by 1.
4836                  */
4837                 phy_idx = cb->args[0] - 1;
4838         } else {
4839                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
4840                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
4841                                   nl80211_policy);
4842                 if (err)
4843                         return err;
4844                 if (nl80211_fam.attrbuf[NL80211_ATTR_WIPHY]) {
4845                         phy_idx = nla_get_u32(
4846                                 nl80211_fam.attrbuf[NL80211_ATTR_WIPHY]);
4847                 } else {
4848                         struct net_device *netdev;
4849
4850                         err = get_rdev_dev_by_ifindex(sock_net(skb->sk),
4851                                                       nl80211_fam.attrbuf,
4852                                                       &rdev, &netdev);
4853                         if (err)
4854                                 return err;
4855                         dev_put(netdev);
4856                         phy_idx = rdev->wiphy_idx;
4857                         cfg80211_unlock_rdev(rdev);
4858                 }
4859                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
4860                         cb->args[1] =
4861                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
4862         }
4863
4864         if (cb->args[1]) {
4865                 data = nla_data((void *)cb->args[1]);
4866                 data_len = nla_len((void *)cb->args[1]);
4867         }
4868
4869         mutex_lock(&cfg80211_mutex);
4870         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
4871         if (!rdev) {
4872                 mutex_unlock(&cfg80211_mutex);
4873                 return -ENOENT;
4874         }
4875         cfg80211_lock_rdev(rdev);
4876         mutex_unlock(&cfg80211_mutex);
4877
4878         if (!rdev->ops->testmode_dump) {
4879                 err = -EOPNOTSUPP;
4880                 goto out_err;
4881         }
4882
4883         while (1) {
4884                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).pid,
4885                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
4886                                            NL80211_CMD_TESTMODE);
4887                 struct nlattr *tmdata;
4888
4889                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx) < 0) {
4890                         genlmsg_cancel(skb, hdr);
4891                         break;
4892                 }
4893
4894                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
4895                 if (!tmdata) {
4896                         genlmsg_cancel(skb, hdr);
4897                         break;
4898                 }
4899                 err = rdev->ops->testmode_dump(&rdev->wiphy, skb, cb,
4900                                                data, data_len);
4901                 nla_nest_end(skb, tmdata);
4902
4903                 if (err == -ENOBUFS || err == -ENOENT) {
4904                         genlmsg_cancel(skb, hdr);
4905                         break;
4906                 } else if (err) {
4907                         genlmsg_cancel(skb, hdr);
4908                         goto out_err;
4909                 }
4910
4911                 genlmsg_end(skb, hdr);
4912         }
4913
4914         err = skb->len;
4915         /* see above */
4916         cb->args[0] = phy_idx + 1;
4917  out_err:
4918         cfg80211_unlock_rdev(rdev);
4919         return err;
4920 }
4921
4922 static struct sk_buff *
4923 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
4924                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
4925 {
4926         struct sk_buff *skb;
4927         void *hdr;
4928         struct nlattr *data;
4929
4930         skb = nlmsg_new(approxlen + 100, gfp);
4931         if (!skb)
4932                 return NULL;
4933
4934         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
4935         if (!hdr) {
4936                 kfree_skb(skb);
4937                 return NULL;
4938         }
4939
4940         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4941         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
4942
4943         ((void **)skb->cb)[0] = rdev;
4944         ((void **)skb->cb)[1] = hdr;
4945         ((void **)skb->cb)[2] = data;
4946
4947         return skb;
4948
4949  nla_put_failure:
4950         kfree_skb(skb);
4951         return NULL;
4952 }
4953
4954 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
4955                                                   int approxlen)
4956 {
4957         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4958
4959         if (WARN_ON(!rdev->testmode_info))
4960                 return NULL;
4961
4962         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
4963                                 rdev->testmode_info->snd_pid,
4964                                 rdev->testmode_info->snd_seq,
4965                                 GFP_KERNEL);
4966 }
4967 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
4968
4969 int cfg80211_testmode_reply(struct sk_buff *skb)
4970 {
4971         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
4972         void *hdr = ((void **)skb->cb)[1];
4973         struct nlattr *data = ((void **)skb->cb)[2];
4974
4975         if (WARN_ON(!rdev->testmode_info)) {
4976                 kfree_skb(skb);
4977                 return -EINVAL;
4978         }
4979
4980         nla_nest_end(skb, data);
4981         genlmsg_end(skb, hdr);
4982         return genlmsg_reply(skb, rdev->testmode_info);
4983 }
4984 EXPORT_SYMBOL(cfg80211_testmode_reply);
4985
4986 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
4987                                                   int approxlen, gfp_t gfp)
4988 {
4989         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4990
4991         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
4992 }
4993 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
4994
4995 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
4996 {
4997         void *hdr = ((void **)skb->cb)[1];
4998         struct nlattr *data = ((void **)skb->cb)[2];
4999
5000         nla_nest_end(skb, data);
5001         genlmsg_end(skb, hdr);
5002         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
5003 }
5004 EXPORT_SYMBOL(cfg80211_testmode_event);
5005 #endif
5006
5007 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
5008 {
5009         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5010         struct net_device *dev = info->user_ptr[1];
5011         struct cfg80211_connect_params connect;
5012         struct wiphy *wiphy;
5013         struct cfg80211_cached_keys *connkeys = NULL;
5014         int err;
5015
5016         memset(&connect, 0, sizeof(connect));
5017
5018         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5019                 return -EINVAL;
5020
5021         if (!info->attrs[NL80211_ATTR_SSID] ||
5022             !nla_len(info->attrs[NL80211_ATTR_SSID]))
5023                 return -EINVAL;
5024
5025         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
5026                 connect.auth_type =
5027                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5028                 if (!nl80211_valid_auth_type(connect.auth_type))
5029                         return -EINVAL;
5030         } else
5031                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
5032
5033         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
5034
5035         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
5036                                       NL80211_MAX_NR_CIPHER_SUITES);
5037         if (err)
5038                 return err;
5039
5040         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5041             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5042                 return -EOPNOTSUPP;
5043
5044         wiphy = &rdev->wiphy;
5045
5046         if (info->attrs[NL80211_ATTR_MAC])
5047                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5048         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5049         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5050
5051         if (info->attrs[NL80211_ATTR_IE]) {
5052                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5053                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5054         }
5055
5056         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
5057                 connect.channel =
5058                         ieee80211_get_channel(wiphy,
5059                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5060                 if (!connect.channel ||
5061                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
5062                         return -EINVAL;
5063         }
5064
5065         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
5066                 connkeys = nl80211_parse_connkeys(rdev,
5067                                         info->attrs[NL80211_ATTR_KEYS]);
5068                 if (IS_ERR(connkeys))
5069                         return PTR_ERR(connkeys);
5070         }
5071
5072         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
5073                 connect.flags |= ASSOC_REQ_DISABLE_HT;
5074
5075         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5076                 memcpy(&connect.ht_capa_mask,
5077                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
5078                        sizeof(connect.ht_capa_mask));
5079
5080         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
5081                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5082                         return -EINVAL;
5083                 memcpy(&connect.ht_capa,
5084                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
5085                        sizeof(connect.ht_capa));
5086         }
5087
5088         err = cfg80211_connect(rdev, dev, &connect, connkeys);
5089         if (err)
5090                 kfree(connkeys);
5091         return err;
5092 }
5093
5094 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
5095 {
5096         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5097         struct net_device *dev = info->user_ptr[1];
5098         u16 reason;
5099
5100         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5101                 reason = WLAN_REASON_DEAUTH_LEAVING;
5102         else
5103                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5104
5105         if (reason == 0)
5106                 return -EINVAL;
5107
5108         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5109             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5110                 return -EOPNOTSUPP;
5111
5112         return cfg80211_disconnect(rdev, dev, reason, true);
5113 }
5114
5115 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
5116 {
5117         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5118         struct net *net;
5119         int err;
5120         u32 pid;
5121
5122         if (!info->attrs[NL80211_ATTR_PID])
5123                 return -EINVAL;
5124
5125         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
5126
5127         net = get_net_ns_by_pid(pid);
5128         if (IS_ERR(net))
5129                 return PTR_ERR(net);
5130
5131         err = 0;
5132
5133         /* check if anything to do */
5134         if (!net_eq(wiphy_net(&rdev->wiphy), net))
5135                 err = cfg80211_switch_netns(rdev, net);
5136
5137         put_net(net);
5138         return err;
5139 }
5140
5141 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
5142 {
5143         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5144         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
5145                         struct cfg80211_pmksa *pmksa) = NULL;
5146         struct net_device *dev = info->user_ptr[1];
5147         struct cfg80211_pmksa pmksa;
5148
5149         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
5150
5151         if (!info->attrs[NL80211_ATTR_MAC])
5152                 return -EINVAL;
5153
5154         if (!info->attrs[NL80211_ATTR_PMKID])
5155                 return -EINVAL;
5156
5157         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
5158         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5159
5160         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5161             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5162                 return -EOPNOTSUPP;
5163
5164         switch (info->genlhdr->cmd) {
5165         case NL80211_CMD_SET_PMKSA:
5166                 rdev_ops = rdev->ops->set_pmksa;
5167                 break;
5168         case NL80211_CMD_DEL_PMKSA:
5169                 rdev_ops = rdev->ops->del_pmksa;
5170                 break;
5171         default:
5172                 WARN_ON(1);
5173                 break;
5174         }
5175
5176         if (!rdev_ops)
5177                 return -EOPNOTSUPP;
5178
5179         return rdev_ops(&rdev->wiphy, dev, &pmksa);
5180 }
5181
5182 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
5183 {
5184         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5185         struct net_device *dev = info->user_ptr[1];
5186
5187         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5188             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5189                 return -EOPNOTSUPP;
5190
5191         if (!rdev->ops->flush_pmksa)
5192                 return -EOPNOTSUPP;
5193
5194         return rdev->ops->flush_pmksa(&rdev->wiphy, dev);
5195 }
5196
5197 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
5198 {
5199         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5200         struct net_device *dev = info->user_ptr[1];
5201         u8 action_code, dialog_token;
5202         u16 status_code;
5203         u8 *peer;
5204
5205         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
5206             !rdev->ops->tdls_mgmt)
5207                 return -EOPNOTSUPP;
5208
5209         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
5210             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
5211             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
5212             !info->attrs[NL80211_ATTR_IE] ||
5213             !info->attrs[NL80211_ATTR_MAC])
5214                 return -EINVAL;
5215
5216         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
5217         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
5218         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
5219         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
5220
5221         return rdev->ops->tdls_mgmt(&rdev->wiphy, dev, peer, action_code,
5222                                     dialog_token, status_code,
5223                                     nla_data(info->attrs[NL80211_ATTR_IE]),
5224                                     nla_len(info->attrs[NL80211_ATTR_IE]));
5225 }
5226
5227 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
5228 {
5229         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5230         struct net_device *dev = info->user_ptr[1];
5231         enum nl80211_tdls_operation operation;
5232         u8 *peer;
5233
5234         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
5235             !rdev->ops->tdls_oper)
5236                 return -EOPNOTSUPP;
5237
5238         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
5239             !info->attrs[NL80211_ATTR_MAC])
5240                 return -EINVAL;
5241
5242         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
5243         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
5244
5245         return rdev->ops->tdls_oper(&rdev->wiphy, dev, peer, operation);
5246 }
5247
5248 static int nl80211_remain_on_channel(struct sk_buff *skb,
5249                                      struct genl_info *info)
5250 {
5251         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5252         struct net_device *dev = info->user_ptr[1];
5253         struct ieee80211_channel *chan;
5254         struct sk_buff *msg;
5255         void *hdr;
5256         u64 cookie;
5257         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
5258         u32 freq, duration;
5259         int err;
5260
5261         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5262             !info->attrs[NL80211_ATTR_DURATION])
5263                 return -EINVAL;
5264
5265         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
5266
5267         /*
5268          * We should be on that channel for at least one jiffie,
5269          * and more than 5 seconds seems excessive.
5270          */
5271         if (!duration || !msecs_to_jiffies(duration) ||
5272             duration > rdev->wiphy.max_remain_on_channel_duration)
5273                 return -EINVAL;
5274
5275         if (!rdev->ops->remain_on_channel ||
5276             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
5277                 return -EOPNOTSUPP;
5278
5279         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
5280                 channel_type = nla_get_u32(
5281                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
5282                 if (channel_type != NL80211_CHAN_NO_HT &&
5283                     channel_type != NL80211_CHAN_HT20 &&
5284                     channel_type != NL80211_CHAN_HT40PLUS &&
5285                     channel_type != NL80211_CHAN_HT40MINUS)
5286                         return -EINVAL;
5287         }
5288
5289         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
5290         chan = rdev_freq_to_chan(rdev, freq, channel_type);
5291         if (chan == NULL)
5292                 return -EINVAL;
5293
5294         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5295         if (!msg)
5296                 return -ENOMEM;
5297
5298         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5299                              NL80211_CMD_REMAIN_ON_CHANNEL);
5300
5301         if (IS_ERR(hdr)) {
5302                 err = PTR_ERR(hdr);
5303                 goto free_msg;
5304         }
5305
5306         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
5307                                            channel_type, duration, &cookie);
5308
5309         if (err)
5310                 goto free_msg;
5311
5312         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5313
5314         genlmsg_end(msg, hdr);
5315
5316         return genlmsg_reply(msg, info);
5317
5318  nla_put_failure:
5319         err = -ENOBUFS;
5320  free_msg:
5321         nlmsg_free(msg);
5322         return err;
5323 }
5324
5325 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
5326                                             struct genl_info *info)
5327 {
5328         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5329         struct net_device *dev = info->user_ptr[1];
5330         u64 cookie;
5331
5332         if (!info->attrs[NL80211_ATTR_COOKIE])
5333                 return -EINVAL;
5334
5335         if (!rdev->ops->cancel_remain_on_channel)
5336                 return -EOPNOTSUPP;
5337
5338         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
5339
5340         return rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
5341 }
5342
5343 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
5344                            u8 *rates, u8 rates_len)
5345 {
5346         u8 i;
5347         u32 mask = 0;
5348
5349         for (i = 0; i < rates_len; i++) {
5350                 int rate = (rates[i] & 0x7f) * 5;
5351                 int ridx;
5352                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
5353                         struct ieee80211_rate *srate =
5354                                 &sband->bitrates[ridx];
5355                         if (rate == srate->bitrate) {
5356                                 mask |= 1 << ridx;
5357                                 break;
5358                         }
5359                 }
5360                 if (ridx == sband->n_bitrates)
5361                         return 0; /* rate not found */
5362         }
5363
5364         return mask;
5365 }
5366
5367 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
5368         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
5369                                     .len = NL80211_MAX_SUPP_RATES },
5370 };
5371
5372 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
5373                                        struct genl_info *info)
5374 {
5375         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5376         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5377         struct cfg80211_bitrate_mask mask;
5378         int rem, i;
5379         struct net_device *dev = info->user_ptr[1];
5380         struct nlattr *tx_rates;
5381         struct ieee80211_supported_band *sband;
5382
5383         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
5384                 return -EINVAL;
5385
5386         if (!rdev->ops->set_bitrate_mask)
5387                 return -EOPNOTSUPP;
5388
5389         memset(&mask, 0, sizeof(mask));
5390         /* Default to all rates enabled */
5391         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
5392                 sband = rdev->wiphy.bands[i];
5393                 mask.control[i].legacy =
5394                         sband ? (1 << sband->n_bitrates) - 1 : 0;
5395         }
5396
5397         /*
5398          * The nested attribute uses enum nl80211_band as the index. This maps
5399          * directly to the enum ieee80211_band values used in cfg80211.
5400          */
5401         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
5402         {
5403                 enum ieee80211_band band = nla_type(tx_rates);
5404                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
5405                         return -EINVAL;
5406                 sband = rdev->wiphy.bands[band];
5407                 if (sband == NULL)
5408                         return -EINVAL;
5409                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
5410                           nla_len(tx_rates), nl80211_txattr_policy);
5411                 if (tb[NL80211_TXRATE_LEGACY]) {
5412                         mask.control[band].legacy = rateset_to_mask(
5413                                 sband,
5414                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
5415                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
5416                         if (mask.control[band].legacy == 0)
5417                                 return -EINVAL;
5418                 }
5419         }
5420
5421         return rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
5422 }
5423
5424 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
5425 {
5426         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5427         struct net_device *dev = info->user_ptr[1];
5428         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
5429
5430         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
5431                 return -EINVAL;
5432
5433         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
5434                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
5435
5436         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5437             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5438             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5439             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5440             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5441             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5442             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5443                 return -EOPNOTSUPP;
5444
5445         /* not much point in registering if we can't reply */
5446         if (!rdev->ops->mgmt_tx)
5447                 return -EOPNOTSUPP;
5448
5449         return cfg80211_mlme_register_mgmt(dev->ieee80211_ptr, info->snd_pid,
5450                         frame_type,
5451                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
5452                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
5453 }
5454
5455 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
5456 {
5457         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5458         struct net_device *dev = info->user_ptr[1];
5459         struct ieee80211_channel *chan;
5460         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
5461         bool channel_type_valid = false;
5462         u32 freq;
5463         int err;
5464         void *hdr = NULL;
5465         u64 cookie;
5466         struct sk_buff *msg = NULL;
5467         unsigned int wait = 0;
5468         bool offchan, no_cck, dont_wait_for_ack;
5469
5470         dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
5471
5472         if (!info->attrs[NL80211_ATTR_FRAME] ||
5473             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
5474                 return -EINVAL;
5475
5476         if (!rdev->ops->mgmt_tx)
5477                 return -EOPNOTSUPP;
5478
5479         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5480             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5481             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5482             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5483             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5484             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5485             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5486                 return -EOPNOTSUPP;
5487
5488         if (info->attrs[NL80211_ATTR_DURATION]) {
5489                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
5490                         return -EINVAL;
5491                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
5492         }
5493
5494         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
5495                 channel_type = nla_get_u32(
5496                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
5497                 if (channel_type != NL80211_CHAN_NO_HT &&
5498                     channel_type != NL80211_CHAN_HT20 &&
5499                     channel_type != NL80211_CHAN_HT40PLUS &&
5500                     channel_type != NL80211_CHAN_HT40MINUS)
5501                         return -EINVAL;
5502                 channel_type_valid = true;
5503         }
5504
5505         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
5506
5507         if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
5508                 return -EINVAL;
5509
5510         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5511
5512         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
5513         chan = rdev_freq_to_chan(rdev, freq, channel_type);
5514         if (chan == NULL)
5515                 return -EINVAL;
5516
5517         if (!dont_wait_for_ack) {
5518                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5519                 if (!msg)
5520                         return -ENOMEM;
5521
5522                 hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5523                                      NL80211_CMD_FRAME);
5524
5525                 if (IS_ERR(hdr)) {
5526                         err = PTR_ERR(hdr);
5527                         goto free_msg;
5528                 }
5529         }
5530
5531         err = cfg80211_mlme_mgmt_tx(rdev, dev, chan, offchan, channel_type,
5532                                     channel_type_valid, wait,
5533                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
5534                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
5535                                     no_cck, dont_wait_for_ack, &cookie);
5536         if (err)
5537                 goto free_msg;
5538
5539         if (msg) {
5540                 NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5541
5542                 genlmsg_end(msg, hdr);
5543                 return genlmsg_reply(msg, info);
5544         }
5545
5546         return 0;
5547
5548  nla_put_failure:
5549         err = -ENOBUFS;
5550  free_msg:
5551         nlmsg_free(msg);
5552         return err;
5553 }
5554
5555 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
5556 {
5557         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5558         struct net_device *dev = info->user_ptr[1];
5559         u64 cookie;
5560
5561         if (!info->attrs[NL80211_ATTR_COOKIE])
5562                 return -EINVAL;
5563
5564         if (!rdev->ops->mgmt_tx_cancel_wait)
5565                 return -EOPNOTSUPP;
5566
5567         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5568             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5569             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5570             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5571             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5572             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5573                 return -EOPNOTSUPP;
5574
5575         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
5576
5577         return rdev->ops->mgmt_tx_cancel_wait(&rdev->wiphy, dev, cookie);
5578 }
5579
5580 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
5581 {
5582         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5583         struct wireless_dev *wdev;
5584         struct net_device *dev = info->user_ptr[1];
5585         u8 ps_state;
5586         bool state;
5587         int err;
5588
5589         if (!info->attrs[NL80211_ATTR_PS_STATE])
5590                 return -EINVAL;
5591
5592         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
5593
5594         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
5595                 return -EINVAL;
5596
5597         wdev = dev->ieee80211_ptr;
5598
5599         if (!rdev->ops->set_power_mgmt)
5600                 return -EOPNOTSUPP;
5601
5602         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
5603
5604         if (state == wdev->ps)
5605                 return 0;
5606
5607         err = rdev->ops->set_power_mgmt(wdev->wiphy, dev, state,
5608                                         wdev->ps_timeout);
5609         if (!err)
5610                 wdev->ps = state;
5611         return err;
5612 }
5613
5614 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
5615 {
5616         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5617         enum nl80211_ps_state ps_state;
5618         struct wireless_dev *wdev;
5619         struct net_device *dev = info->user_ptr[1];
5620         struct sk_buff *msg;
5621         void *hdr;
5622         int err;
5623
5624         wdev = dev->ieee80211_ptr;
5625
5626         if (!rdev->ops->set_power_mgmt)
5627                 return -EOPNOTSUPP;
5628
5629         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5630         if (!msg)
5631                 return -ENOMEM;
5632
5633         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5634                              NL80211_CMD_GET_POWER_SAVE);
5635         if (!hdr) {
5636                 err = -ENOBUFS;
5637                 goto free_msg;
5638         }
5639
5640         if (wdev->ps)
5641                 ps_state = NL80211_PS_ENABLED;
5642         else
5643                 ps_state = NL80211_PS_DISABLED;
5644
5645         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
5646
5647         genlmsg_end(msg, hdr);
5648         return genlmsg_reply(msg, info);
5649
5650  nla_put_failure:
5651         err = -ENOBUFS;
5652  free_msg:
5653         nlmsg_free(msg);
5654         return err;
5655 }
5656
5657 static struct nla_policy
5658 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
5659         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
5660         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
5661         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
5662 };
5663
5664 static int nl80211_set_cqm_rssi(struct genl_info *info,
5665                                 s32 threshold, u32 hysteresis)
5666 {
5667         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5668         struct wireless_dev *wdev;
5669         struct net_device *dev = info->user_ptr[1];
5670
5671         if (threshold > 0)
5672                 return -EINVAL;
5673
5674         wdev = dev->ieee80211_ptr;
5675
5676         if (!rdev->ops->set_cqm_rssi_config)
5677                 return -EOPNOTSUPP;
5678
5679         if (wdev->iftype != NL80211_IFTYPE_STATION &&
5680             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
5681                 return -EOPNOTSUPP;
5682
5683         return rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
5684                                               threshold, hysteresis);
5685 }
5686
5687 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
5688 {
5689         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
5690         struct nlattr *cqm;
5691         int err;
5692
5693         cqm = info->attrs[NL80211_ATTR_CQM];
5694         if (!cqm) {
5695                 err = -EINVAL;
5696                 goto out;
5697         }
5698
5699         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
5700                                nl80211_attr_cqm_policy);
5701         if (err)
5702                 goto out;
5703
5704         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
5705             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
5706                 s32 threshold;
5707                 u32 hysteresis;
5708                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
5709                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
5710                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
5711         } else
5712                 err = -EINVAL;
5713
5714 out:
5715         return err;
5716 }
5717
5718 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
5719 {
5720         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5721         struct net_device *dev = info->user_ptr[1];
5722         struct mesh_config cfg;
5723         struct mesh_setup setup;
5724         int err;
5725
5726         /* start with default */
5727         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
5728         memcpy(&setup, &default_mesh_setup, sizeof(setup));
5729
5730         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
5731                 /* and parse parameters if given */
5732                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
5733                 if (err)
5734                         return err;
5735         }
5736
5737         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
5738             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
5739                 return -EINVAL;
5740
5741         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
5742         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
5743
5744         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
5745             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
5746                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
5747                         return -EINVAL;
5748
5749         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
5750                 /* parse additional setup parameters if given */
5751                 err = nl80211_parse_mesh_setup(info, &setup);
5752                 if (err)
5753                         return err;
5754         }
5755
5756         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
5757 }
5758
5759 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
5760 {
5761         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5762         struct net_device *dev = info->user_ptr[1];
5763
5764         return cfg80211_leave_mesh(rdev, dev);
5765 }
5766
5767 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
5768 {
5769         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5770         struct sk_buff *msg;
5771         void *hdr;
5772
5773         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
5774                 return -EOPNOTSUPP;
5775
5776         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5777         if (!msg)
5778                 return -ENOMEM;
5779
5780         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5781                              NL80211_CMD_GET_WOWLAN);
5782         if (!hdr)
5783                 goto nla_put_failure;
5784
5785         if (rdev->wowlan) {
5786                 struct nlattr *nl_wowlan;
5787
5788                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
5789                 if (!nl_wowlan)
5790                         goto nla_put_failure;
5791
5792                 if (rdev->wowlan->any)
5793                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
5794                 if (rdev->wowlan->disconnect)
5795                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
5796                 if (rdev->wowlan->magic_pkt)
5797                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
5798                 if (rdev->wowlan->gtk_rekey_failure)
5799                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
5800                 if (rdev->wowlan->eap_identity_req)
5801                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
5802                 if (rdev->wowlan->four_way_handshake)
5803                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
5804                 if (rdev->wowlan->rfkill_release)
5805                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
5806                 if (rdev->wowlan->n_patterns) {
5807                         struct nlattr *nl_pats, *nl_pat;
5808                         int i, pat_len;
5809
5810                         nl_pats = nla_nest_start(msg,
5811                                         NL80211_WOWLAN_TRIG_PKT_PATTERN);
5812                         if (!nl_pats)
5813                                 goto nla_put_failure;
5814
5815                         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
5816                                 nl_pat = nla_nest_start(msg, i + 1);
5817                                 if (!nl_pat)
5818                                         goto nla_put_failure;
5819                                 pat_len = rdev->wowlan->patterns[i].pattern_len;
5820                                 NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_MASK,
5821                                         DIV_ROUND_UP(pat_len, 8),
5822                                         rdev->wowlan->patterns[i].mask);
5823                                 NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
5824                                         pat_len,
5825                                         rdev->wowlan->patterns[i].pattern);
5826                                 nla_nest_end(msg, nl_pat);
5827                         }
5828                         nla_nest_end(msg, nl_pats);
5829                 }
5830
5831                 nla_nest_end(msg, nl_wowlan);
5832         }
5833
5834         genlmsg_end(msg, hdr);
5835         return genlmsg_reply(msg, info);
5836
5837 nla_put_failure:
5838         nlmsg_free(msg);
5839         return -ENOBUFS;
5840 }
5841
5842 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
5843 {
5844         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5845         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
5846         struct cfg80211_wowlan no_triggers = {};
5847         struct cfg80211_wowlan new_triggers = {};
5848         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
5849         int err, i;
5850
5851         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
5852                 return -EOPNOTSUPP;
5853
5854         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS])
5855                 goto no_triggers;
5856
5857         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
5858                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
5859                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
5860                         nl80211_wowlan_policy);
5861         if (err)
5862                 return err;
5863
5864         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
5865                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
5866                         return -EINVAL;
5867                 new_triggers.any = true;
5868         }
5869
5870         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
5871                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
5872                         return -EINVAL;
5873                 new_triggers.disconnect = true;
5874         }
5875
5876         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
5877                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
5878                         return -EINVAL;
5879                 new_triggers.magic_pkt = true;
5880         }
5881
5882         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
5883                 return -EINVAL;
5884
5885         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
5886                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
5887                         return -EINVAL;
5888                 new_triggers.gtk_rekey_failure = true;
5889         }
5890
5891         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
5892                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
5893                         return -EINVAL;
5894                 new_triggers.eap_identity_req = true;
5895         }
5896
5897         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
5898                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
5899                         return -EINVAL;
5900                 new_triggers.four_way_handshake = true;
5901         }
5902
5903         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
5904                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
5905                         return -EINVAL;
5906                 new_triggers.rfkill_release = true;
5907         }
5908
5909         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
5910                 struct nlattr *pat;
5911                 int n_patterns = 0;
5912                 int rem, pat_len, mask_len;
5913                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
5914
5915                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
5916                                     rem)
5917                         n_patterns++;
5918                 if (n_patterns > wowlan->n_patterns)
5919                         return -EINVAL;
5920
5921                 new_triggers.patterns = kcalloc(n_patterns,
5922                                                 sizeof(new_triggers.patterns[0]),
5923                                                 GFP_KERNEL);
5924                 if (!new_triggers.patterns)
5925                         return -ENOMEM;
5926
5927                 new_triggers.n_patterns = n_patterns;
5928                 i = 0;
5929
5930                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
5931                                     rem) {
5932                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
5933                                   nla_data(pat), nla_len(pat), NULL);
5934                         err = -EINVAL;
5935                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
5936                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
5937                                 goto error;
5938                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
5939                         mask_len = DIV_ROUND_UP(pat_len, 8);
5940                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
5941                             mask_len)
5942                                 goto error;
5943                         if (pat_len > wowlan->pattern_max_len ||
5944                             pat_len < wowlan->pattern_min_len)
5945                                 goto error;
5946
5947                         new_triggers.patterns[i].mask =
5948                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
5949                         if (!new_triggers.patterns[i].mask) {
5950                                 err = -ENOMEM;
5951                                 goto error;
5952                         }
5953                         new_triggers.patterns[i].pattern =
5954                                 new_triggers.patterns[i].mask + mask_len;
5955                         memcpy(new_triggers.patterns[i].mask,
5956                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
5957                                mask_len);
5958                         new_triggers.patterns[i].pattern_len = pat_len;
5959                         memcpy(new_triggers.patterns[i].pattern,
5960                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
5961                                pat_len);
5962                         i++;
5963                 }
5964         }
5965
5966         if (memcmp(&new_triggers, &no_triggers, sizeof(new_triggers))) {
5967                 struct cfg80211_wowlan *ntrig;
5968                 ntrig = kmemdup(&new_triggers, sizeof(new_triggers),
5969                                 GFP_KERNEL);
5970                 if (!ntrig) {
5971                         err = -ENOMEM;
5972                         goto error;
5973                 }
5974                 cfg80211_rdev_free_wowlan(rdev);
5975                 rdev->wowlan = ntrig;
5976         } else {
5977  no_triggers:
5978                 cfg80211_rdev_free_wowlan(rdev);
5979                 rdev->wowlan = NULL;
5980         }
5981
5982         return 0;
5983  error:
5984         for (i = 0; i < new_triggers.n_patterns; i++)
5985                 kfree(new_triggers.patterns[i].mask);
5986         kfree(new_triggers.patterns);
5987         return err;
5988 }
5989
5990 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
5991 {
5992         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5993         struct net_device *dev = info->user_ptr[1];
5994         struct wireless_dev *wdev = dev->ieee80211_ptr;
5995         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
5996         struct cfg80211_gtk_rekey_data rekey_data;
5997         int err;
5998
5999         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
6000                 return -EINVAL;
6001
6002         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
6003                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
6004                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
6005                         nl80211_rekey_policy);
6006         if (err)
6007                 return err;
6008
6009         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
6010                 return -ERANGE;
6011         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
6012                 return -ERANGE;
6013         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
6014                 return -ERANGE;
6015
6016         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
6017                NL80211_KEK_LEN);
6018         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
6019                NL80211_KCK_LEN);
6020         memcpy(rekey_data.replay_ctr,
6021                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
6022                NL80211_REPLAY_CTR_LEN);
6023
6024         wdev_lock(wdev);
6025         if (!wdev->current_bss) {
6026                 err = -ENOTCONN;
6027                 goto out;
6028         }
6029
6030         if (!rdev->ops->set_rekey_data) {
6031                 err = -EOPNOTSUPP;
6032                 goto out;
6033         }
6034
6035         err = rdev->ops->set_rekey_data(&rdev->wiphy, dev, &rekey_data);
6036  out:
6037         wdev_unlock(wdev);
6038         return err;
6039 }
6040
6041 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
6042                                              struct genl_info *info)
6043 {
6044         struct net_device *dev = info->user_ptr[1];
6045         struct wireless_dev *wdev = dev->ieee80211_ptr;
6046
6047         if (wdev->iftype != NL80211_IFTYPE_AP &&
6048             wdev->iftype != NL80211_IFTYPE_P2P_GO)
6049                 return -EINVAL;
6050
6051         if (wdev->ap_unexpected_nlpid)
6052                 return -EBUSY;
6053
6054         wdev->ap_unexpected_nlpid = info->snd_pid;
6055         return 0;
6056 }
6057
6058 static int nl80211_probe_client(struct sk_buff *skb,
6059                                 struct genl_info *info)
6060 {
6061         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6062         struct net_device *dev = info->user_ptr[1];
6063         struct wireless_dev *wdev = dev->ieee80211_ptr;
6064         struct sk_buff *msg;
6065         void *hdr;
6066         const u8 *addr;
6067         u64 cookie;
6068         int err;
6069
6070         if (wdev->iftype != NL80211_IFTYPE_AP &&
6071             wdev->iftype != NL80211_IFTYPE_P2P_GO)
6072                 return -EOPNOTSUPP;
6073
6074         if (!info->attrs[NL80211_ATTR_MAC])
6075                 return -EINVAL;
6076
6077         if (!rdev->ops->probe_client)
6078                 return -EOPNOTSUPP;
6079
6080         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6081         if (!msg)
6082                 return -ENOMEM;
6083
6084         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
6085                              NL80211_CMD_PROBE_CLIENT);
6086
6087         if (IS_ERR(hdr)) {
6088                 err = PTR_ERR(hdr);
6089                 goto free_msg;
6090         }
6091
6092         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6093
6094         err = rdev->ops->probe_client(&rdev->wiphy, dev, addr, &cookie);
6095         if (err)
6096                 goto free_msg;
6097
6098         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
6099
6100         genlmsg_end(msg, hdr);
6101
6102         return genlmsg_reply(msg, info);
6103
6104  nla_put_failure:
6105         err = -ENOBUFS;
6106  free_msg:
6107         nlmsg_free(msg);
6108         return err;
6109 }
6110
6111 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
6112 {
6113         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6114
6115         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
6116                 return -EOPNOTSUPP;
6117
6118         if (rdev->ap_beacons_nlpid)
6119                 return -EBUSY;
6120
6121         rdev->ap_beacons_nlpid = info->snd_pid;
6122
6123         return 0;
6124 }
6125
6126 #define NL80211_FLAG_NEED_WIPHY         0x01
6127 #define NL80211_FLAG_NEED_NETDEV        0x02
6128 #define NL80211_FLAG_NEED_RTNL          0x04
6129 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
6130 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
6131                                          NL80211_FLAG_CHECK_NETDEV_UP)
6132
6133 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
6134                             struct genl_info *info)
6135 {
6136         struct cfg80211_registered_device *rdev;
6137         struct net_device *dev;
6138         int err;
6139         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
6140
6141         if (rtnl)
6142                 rtnl_lock();
6143
6144         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
6145                 rdev = cfg80211_get_dev_from_info(info);
6146                 if (IS_ERR(rdev)) {
6147                         if (rtnl)
6148                                 rtnl_unlock();
6149                         return PTR_ERR(rdev);
6150                 }
6151                 info->user_ptr[0] = rdev;
6152         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
6153                 err = get_rdev_dev_by_ifindex(genl_info_net(info), info->attrs,
6154                                               &rdev, &dev);
6155                 if (err) {
6156                         if (rtnl)
6157                                 rtnl_unlock();
6158                         return err;
6159                 }
6160                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
6161                     !netif_running(dev)) {
6162                         cfg80211_unlock_rdev(rdev);
6163                         dev_put(dev);
6164                         if (rtnl)
6165                                 rtnl_unlock();
6166                         return -ENETDOWN;
6167                 }
6168                 info->user_ptr[0] = rdev;
6169                 info->user_ptr[1] = dev;
6170         }
6171
6172         return 0;
6173 }
6174
6175 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
6176                               struct genl_info *info)
6177 {
6178         if (info->user_ptr[0])
6179                 cfg80211_unlock_rdev(info->user_ptr[0]);
6180         if (info->user_ptr[1])
6181                 dev_put(info->user_ptr[1]);
6182         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
6183                 rtnl_unlock();
6184 }
6185
6186 static struct genl_ops nl80211_ops[] = {
6187         {
6188                 .cmd = NL80211_CMD_GET_WIPHY,
6189                 .doit = nl80211_get_wiphy,
6190                 .dumpit = nl80211_dump_wiphy,
6191                 .policy = nl80211_policy,
6192                 /* can be retrieved by unprivileged users */
6193                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
6194         },
6195         {
6196                 .cmd = NL80211_CMD_SET_WIPHY,
6197                 .doit = nl80211_set_wiphy,
6198                 .policy = nl80211_policy,
6199                 .flags = GENL_ADMIN_PERM,
6200                 .internal_flags = NL80211_FLAG_NEED_RTNL,
6201         },
6202         {
6203                 .cmd = NL80211_CMD_GET_INTERFACE,
6204                 .doit = nl80211_get_interface,
6205                 .dumpit = nl80211_dump_interface,
6206                 .policy = nl80211_policy,
6207                 /* can be retrieved by unprivileged users */
6208                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
6209         },
6210         {
6211                 .cmd = NL80211_CMD_SET_INTERFACE,
6212                 .doit = nl80211_set_interface,
6213                 .policy = nl80211_policy,
6214                 .flags = GENL_ADMIN_PERM,
6215                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6216                                   NL80211_FLAG_NEED_RTNL,
6217         },
6218         {
6219                 .cmd = NL80211_CMD_NEW_INTERFACE,
6220                 .doit = nl80211_new_interface,
6221                 .policy = nl80211_policy,
6222                 .flags = GENL_ADMIN_PERM,
6223                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6224                                   NL80211_FLAG_NEED_RTNL,
6225         },
6226         {
6227                 .cmd = NL80211_CMD_DEL_INTERFACE,
6228                 .doit = nl80211_del_interface,
6229                 .policy = nl80211_policy,
6230                 .flags = GENL_ADMIN_PERM,
6231                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6232                                   NL80211_FLAG_NEED_RTNL,
6233         },
6234         {
6235                 .cmd = NL80211_CMD_GET_KEY,
6236                 .doit = nl80211_get_key,
6237                 .policy = nl80211_policy,
6238                 .flags = GENL_ADMIN_PERM,
6239                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6240                                   NL80211_FLAG_NEED_RTNL,
6241         },
6242         {
6243                 .cmd = NL80211_CMD_SET_KEY,
6244                 .doit = nl80211_set_key,
6245                 .policy = nl80211_policy,
6246                 .flags = GENL_ADMIN_PERM,
6247                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6248                                   NL80211_FLAG_NEED_RTNL,
6249         },
6250         {
6251                 .cmd = NL80211_CMD_NEW_KEY,
6252                 .doit = nl80211_new_key,
6253                 .policy = nl80211_policy,
6254                 .flags = GENL_ADMIN_PERM,
6255                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6256                                   NL80211_FLAG_NEED_RTNL,
6257         },
6258         {
6259                 .cmd = NL80211_CMD_DEL_KEY,
6260                 .doit = nl80211_del_key,
6261                 .policy = nl80211_policy,
6262                 .flags = GENL_ADMIN_PERM,
6263                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6264                                   NL80211_FLAG_NEED_RTNL,
6265         },
6266         {
6267                 .cmd = NL80211_CMD_SET_BEACON,
6268                 .policy = nl80211_policy,
6269                 .flags = GENL_ADMIN_PERM,
6270                 .doit = nl80211_addset_beacon,
6271                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6272                                   NL80211_FLAG_NEED_RTNL,
6273         },
6274         {
6275                 .cmd = NL80211_CMD_NEW_BEACON,
6276                 .policy = nl80211_policy,
6277                 .flags = GENL_ADMIN_PERM,
6278                 .doit = nl80211_addset_beacon,
6279                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6280                                   NL80211_FLAG_NEED_RTNL,
6281         },
6282         {
6283                 .cmd = NL80211_CMD_DEL_BEACON,
6284                 .policy = nl80211_policy,
6285                 .flags = GENL_ADMIN_PERM,
6286                 .doit = nl80211_del_beacon,
6287                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6288                                   NL80211_FLAG_NEED_RTNL,
6289         },
6290         {
6291                 .cmd = NL80211_CMD_GET_STATION,
6292                 .doit = nl80211_get_station,
6293                 .dumpit = nl80211_dump_station,
6294                 .policy = nl80211_policy,
6295                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6296                                   NL80211_FLAG_NEED_RTNL,
6297         },
6298         {
6299                 .cmd = NL80211_CMD_SET_STATION,
6300                 .doit = nl80211_set_station,
6301                 .policy = nl80211_policy,
6302                 .flags = GENL_ADMIN_PERM,
6303                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6304                                   NL80211_FLAG_NEED_RTNL,
6305         },
6306         {
6307                 .cmd = NL80211_CMD_NEW_STATION,
6308                 .doit = nl80211_new_station,
6309                 .policy = nl80211_policy,
6310                 .flags = GENL_ADMIN_PERM,
6311                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6312                                   NL80211_FLAG_NEED_RTNL,
6313         },
6314         {
6315                 .cmd = NL80211_CMD_DEL_STATION,
6316                 .doit = nl80211_del_station,
6317                 .policy = nl80211_policy,
6318                 .flags = GENL_ADMIN_PERM,
6319                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6320                                   NL80211_FLAG_NEED_RTNL,
6321         },
6322         {
6323                 .cmd = NL80211_CMD_GET_MPATH,
6324                 .doit = nl80211_get_mpath,
6325                 .dumpit = nl80211_dump_mpath,
6326                 .policy = nl80211_policy,
6327                 .flags = GENL_ADMIN_PERM,
6328                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6329                                   NL80211_FLAG_NEED_RTNL,
6330         },
6331         {
6332                 .cmd = NL80211_CMD_SET_MPATH,
6333                 .doit = nl80211_set_mpath,
6334                 .policy = nl80211_policy,
6335                 .flags = GENL_ADMIN_PERM,
6336                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6337                                   NL80211_FLAG_NEED_RTNL,
6338         },
6339         {
6340                 .cmd = NL80211_CMD_NEW_MPATH,
6341                 .doit = nl80211_new_mpath,
6342                 .policy = nl80211_policy,
6343                 .flags = GENL_ADMIN_PERM,
6344                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6345                                   NL80211_FLAG_NEED_RTNL,
6346         },
6347         {
6348                 .cmd = NL80211_CMD_DEL_MPATH,
6349                 .doit = nl80211_del_mpath,
6350                 .policy = nl80211_policy,
6351                 .flags = GENL_ADMIN_PERM,
6352                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6353                                   NL80211_FLAG_NEED_RTNL,
6354         },
6355         {
6356                 .cmd = NL80211_CMD_SET_BSS,
6357                 .doit = nl80211_set_bss,
6358                 .policy = nl80211_policy,
6359                 .flags = GENL_ADMIN_PERM,
6360                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6361                                   NL80211_FLAG_NEED_RTNL,
6362         },
6363         {
6364                 .cmd = NL80211_CMD_GET_REG,
6365                 .doit = nl80211_get_reg,
6366                 .policy = nl80211_policy,
6367                 /* can be retrieved by unprivileged users */
6368         },
6369         {
6370                 .cmd = NL80211_CMD_SET_REG,
6371                 .doit = nl80211_set_reg,
6372                 .policy = nl80211_policy,
6373                 .flags = GENL_ADMIN_PERM,
6374         },
6375         {
6376                 .cmd = NL80211_CMD_REQ_SET_REG,
6377                 .doit = nl80211_req_set_reg,
6378                 .policy = nl80211_policy,
6379                 .flags = GENL_ADMIN_PERM,
6380         },
6381         {
6382                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
6383                 .doit = nl80211_get_mesh_config,
6384                 .policy = nl80211_policy,
6385                 /* can be retrieved by unprivileged users */
6386                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6387                                   NL80211_FLAG_NEED_RTNL,
6388         },
6389         {
6390                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
6391                 .doit = nl80211_update_mesh_config,
6392                 .policy = nl80211_policy,
6393                 .flags = GENL_ADMIN_PERM,
6394                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6395                                   NL80211_FLAG_NEED_RTNL,
6396         },
6397         {
6398                 .cmd = NL80211_CMD_TRIGGER_SCAN,
6399                 .doit = nl80211_trigger_scan,
6400                 .policy = nl80211_policy,
6401                 .flags = GENL_ADMIN_PERM,
6402                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6403                                   NL80211_FLAG_NEED_RTNL,
6404         },
6405         {
6406                 .cmd = NL80211_CMD_GET_SCAN,
6407                 .policy = nl80211_policy,
6408                 .dumpit = nl80211_dump_scan,
6409         },
6410         {
6411                 .cmd = NL80211_CMD_START_SCHED_SCAN,
6412                 .doit = nl80211_start_sched_scan,
6413                 .policy = nl80211_policy,
6414                 .flags = GENL_ADMIN_PERM,
6415                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6416                                   NL80211_FLAG_NEED_RTNL,
6417         },
6418         {
6419                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
6420                 .doit = nl80211_stop_sched_scan,
6421                 .policy = nl80211_policy,
6422                 .flags = GENL_ADMIN_PERM,
6423                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6424                                   NL80211_FLAG_NEED_RTNL,
6425         },
6426         {
6427                 .cmd = NL80211_CMD_AUTHENTICATE,
6428                 .doit = nl80211_authenticate,
6429                 .policy = nl80211_policy,
6430                 .flags = GENL_ADMIN_PERM,
6431                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6432                                   NL80211_FLAG_NEED_RTNL,
6433         },
6434         {
6435                 .cmd = NL80211_CMD_ASSOCIATE,
6436                 .doit = nl80211_associate,
6437                 .policy = nl80211_policy,
6438                 .flags = GENL_ADMIN_PERM,
6439                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6440                                   NL80211_FLAG_NEED_RTNL,
6441         },
6442         {
6443                 .cmd = NL80211_CMD_DEAUTHENTICATE,
6444                 .doit = nl80211_deauthenticate,
6445                 .policy = nl80211_policy,
6446                 .flags = GENL_ADMIN_PERM,
6447                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6448                                   NL80211_FLAG_NEED_RTNL,
6449         },
6450         {
6451                 .cmd = NL80211_CMD_DISASSOCIATE,
6452                 .doit = nl80211_disassociate,
6453                 .policy = nl80211_policy,
6454                 .flags = GENL_ADMIN_PERM,
6455                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6456                                   NL80211_FLAG_NEED_RTNL,
6457         },
6458         {
6459                 .cmd = NL80211_CMD_JOIN_IBSS,
6460                 .doit = nl80211_join_ibss,
6461                 .policy = nl80211_policy,
6462                 .flags = GENL_ADMIN_PERM,
6463                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6464                                   NL80211_FLAG_NEED_RTNL,
6465         },
6466         {
6467                 .cmd = NL80211_CMD_LEAVE_IBSS,
6468                 .doit = nl80211_leave_ibss,
6469                 .policy = nl80211_policy,
6470                 .flags = GENL_ADMIN_PERM,
6471                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6472                                   NL80211_FLAG_NEED_RTNL,
6473         },
6474 #ifdef CONFIG_NL80211_TESTMODE
6475         {
6476                 .cmd = NL80211_CMD_TESTMODE,
6477                 .doit = nl80211_testmode_do,
6478                 .dumpit = nl80211_testmode_dump,
6479                 .policy = nl80211_policy,
6480                 .flags = GENL_ADMIN_PERM,
6481                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6482                                   NL80211_FLAG_NEED_RTNL,
6483         },
6484 #endif
6485         {
6486                 .cmd = NL80211_CMD_CONNECT,
6487                 .doit = nl80211_connect,
6488                 .policy = nl80211_policy,
6489                 .flags = GENL_ADMIN_PERM,
6490                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6491                                   NL80211_FLAG_NEED_RTNL,
6492         },
6493         {
6494                 .cmd = NL80211_CMD_DISCONNECT,
6495                 .doit = nl80211_disconnect,
6496                 .policy = nl80211_policy,
6497                 .flags = GENL_ADMIN_PERM,
6498                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6499                                   NL80211_FLAG_NEED_RTNL,
6500         },
6501         {
6502                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
6503                 .doit = nl80211_wiphy_netns,
6504                 .policy = nl80211_policy,
6505                 .flags = GENL_ADMIN_PERM,
6506                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6507                                   NL80211_FLAG_NEED_RTNL,
6508         },
6509         {
6510                 .cmd = NL80211_CMD_GET_SURVEY,
6511                 .policy = nl80211_policy,
6512                 .dumpit = nl80211_dump_survey,
6513         },
6514         {
6515                 .cmd = NL80211_CMD_SET_PMKSA,
6516                 .doit = nl80211_setdel_pmksa,
6517                 .policy = nl80211_policy,
6518                 .flags = GENL_ADMIN_PERM,
6519                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6520                                   NL80211_FLAG_NEED_RTNL,
6521         },
6522         {
6523                 .cmd = NL80211_CMD_DEL_PMKSA,
6524                 .doit = nl80211_setdel_pmksa,
6525                 .policy = nl80211_policy,
6526                 .flags = GENL_ADMIN_PERM,
6527                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6528                                   NL80211_FLAG_NEED_RTNL,
6529         },
6530         {
6531                 .cmd = NL80211_CMD_FLUSH_PMKSA,
6532                 .doit = nl80211_flush_pmksa,
6533                 .policy = nl80211_policy,
6534                 .flags = GENL_ADMIN_PERM,
6535                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6536                                   NL80211_FLAG_NEED_RTNL,
6537         },
6538         {
6539                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
6540                 .doit = nl80211_remain_on_channel,
6541                 .policy = nl80211_policy,
6542                 .flags = GENL_ADMIN_PERM,
6543                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6544                                   NL80211_FLAG_NEED_RTNL,
6545         },
6546         {
6547                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
6548                 .doit = nl80211_cancel_remain_on_channel,
6549                 .policy = nl80211_policy,
6550                 .flags = GENL_ADMIN_PERM,
6551                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6552                                   NL80211_FLAG_NEED_RTNL,
6553         },
6554         {
6555                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
6556                 .doit = nl80211_set_tx_bitrate_mask,
6557                 .policy = nl80211_policy,
6558                 .flags = GENL_ADMIN_PERM,
6559                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6560                                   NL80211_FLAG_NEED_RTNL,
6561         },
6562         {
6563                 .cmd = NL80211_CMD_REGISTER_FRAME,
6564                 .doit = nl80211_register_mgmt,
6565                 .policy = nl80211_policy,
6566                 .flags = GENL_ADMIN_PERM,
6567                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6568                                   NL80211_FLAG_NEED_RTNL,
6569         },
6570         {
6571                 .cmd = NL80211_CMD_FRAME,
6572                 .doit = nl80211_tx_mgmt,
6573                 .policy = nl80211_policy,
6574                 .flags = GENL_ADMIN_PERM,
6575                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6576                                   NL80211_FLAG_NEED_RTNL,
6577         },
6578         {
6579                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
6580                 .doit = nl80211_tx_mgmt_cancel_wait,
6581                 .policy = nl80211_policy,
6582                 .flags = GENL_ADMIN_PERM,
6583                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6584                                   NL80211_FLAG_NEED_RTNL,
6585         },
6586         {
6587                 .cmd = NL80211_CMD_SET_POWER_SAVE,
6588                 .doit = nl80211_set_power_save,
6589                 .policy = nl80211_policy,
6590                 .flags = GENL_ADMIN_PERM,
6591                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6592                                   NL80211_FLAG_NEED_RTNL,
6593         },
6594         {
6595                 .cmd = NL80211_CMD_GET_POWER_SAVE,
6596                 .doit = nl80211_get_power_save,
6597                 .policy = nl80211_policy,
6598                 /* can be retrieved by unprivileged users */
6599                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6600                                   NL80211_FLAG_NEED_RTNL,
6601         },
6602         {
6603                 .cmd = NL80211_CMD_SET_CQM,
6604                 .doit = nl80211_set_cqm,
6605                 .policy = nl80211_policy,
6606                 .flags = GENL_ADMIN_PERM,
6607                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6608                                   NL80211_FLAG_NEED_RTNL,
6609         },
6610         {
6611                 .cmd = NL80211_CMD_SET_CHANNEL,
6612                 .doit = nl80211_set_channel,
6613                 .policy = nl80211_policy,
6614                 .flags = GENL_ADMIN_PERM,
6615                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6616                                   NL80211_FLAG_NEED_RTNL,
6617         },
6618         {
6619                 .cmd = NL80211_CMD_SET_WDS_PEER,
6620                 .doit = nl80211_set_wds_peer,
6621                 .policy = nl80211_policy,
6622                 .flags = GENL_ADMIN_PERM,
6623                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6624                                   NL80211_FLAG_NEED_RTNL,
6625         },
6626         {
6627                 .cmd = NL80211_CMD_JOIN_MESH,
6628                 .doit = nl80211_join_mesh,
6629                 .policy = nl80211_policy,
6630                 .flags = GENL_ADMIN_PERM,
6631                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6632                                   NL80211_FLAG_NEED_RTNL,
6633         },
6634         {
6635                 .cmd = NL80211_CMD_LEAVE_MESH,
6636                 .doit = nl80211_leave_mesh,
6637                 .policy = nl80211_policy,
6638                 .flags = GENL_ADMIN_PERM,
6639                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6640                                   NL80211_FLAG_NEED_RTNL,
6641         },
6642         {
6643                 .cmd = NL80211_CMD_GET_WOWLAN,
6644                 .doit = nl80211_get_wowlan,
6645                 .policy = nl80211_policy,
6646                 /* can be retrieved by unprivileged users */
6647                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6648                                   NL80211_FLAG_NEED_RTNL,
6649         },
6650         {
6651                 .cmd = NL80211_CMD_SET_WOWLAN,
6652                 .doit = nl80211_set_wowlan,
6653                 .policy = nl80211_policy,
6654                 .flags = GENL_ADMIN_PERM,
6655                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6656                                   NL80211_FLAG_NEED_RTNL,
6657         },
6658         {
6659                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
6660                 .doit = nl80211_set_rekey_data,
6661                 .policy = nl80211_policy,
6662                 .flags = GENL_ADMIN_PERM,
6663                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6664                                   NL80211_FLAG_NEED_RTNL,
6665         },
6666         {
6667                 .cmd = NL80211_CMD_TDLS_MGMT,
6668                 .doit = nl80211_tdls_mgmt,
6669                 .policy = nl80211_policy,
6670                 .flags = GENL_ADMIN_PERM,
6671                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6672                                   NL80211_FLAG_NEED_RTNL,
6673         },
6674         {
6675                 .cmd = NL80211_CMD_TDLS_OPER,
6676                 .doit = nl80211_tdls_oper,
6677                 .policy = nl80211_policy,
6678                 .flags = GENL_ADMIN_PERM,
6679                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6680                                   NL80211_FLAG_NEED_RTNL,
6681         },
6682         {
6683                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
6684                 .doit = nl80211_register_unexpected_frame,
6685                 .policy = nl80211_policy,
6686                 .flags = GENL_ADMIN_PERM,
6687                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6688                                   NL80211_FLAG_NEED_RTNL,
6689         },
6690         {
6691                 .cmd = NL80211_CMD_PROBE_CLIENT,
6692                 .doit = nl80211_probe_client,
6693                 .policy = nl80211_policy,
6694                 .flags = GENL_ADMIN_PERM,
6695                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6696                                   NL80211_FLAG_NEED_RTNL,
6697         },
6698         {
6699                 .cmd = NL80211_CMD_REGISTER_BEACONS,
6700                 .doit = nl80211_register_beacons,
6701                 .policy = nl80211_policy,
6702                 .flags = GENL_ADMIN_PERM,
6703                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6704                                   NL80211_FLAG_NEED_RTNL,
6705         },
6706         {
6707                 .cmd = NL80211_CMD_SET_NOACK_MAP,
6708                 .doit = nl80211_set_noack_map,
6709                 .policy = nl80211_policy,
6710                 .flags = GENL_ADMIN_PERM,
6711                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6712                                   NL80211_FLAG_NEED_RTNL,
6713         },
6714
6715 };
6716
6717 static struct genl_multicast_group nl80211_mlme_mcgrp = {
6718         .name = "mlme",
6719 };
6720
6721 /* multicast groups */
6722 static struct genl_multicast_group nl80211_config_mcgrp = {
6723         .name = "config",
6724 };
6725 static struct genl_multicast_group nl80211_scan_mcgrp = {
6726         .name = "scan",
6727 };
6728 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
6729         .name = "regulatory",
6730 };
6731
6732 /* notification functions */
6733
6734 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
6735 {
6736         struct sk_buff *msg;
6737
6738         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6739         if (!msg)
6740                 return;
6741
6742         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
6743                 nlmsg_free(msg);
6744                 return;
6745         }
6746
6747         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6748                                 nl80211_config_mcgrp.id, GFP_KERNEL);
6749 }
6750
6751 static int nl80211_add_scan_req(struct sk_buff *msg,
6752                                 struct cfg80211_registered_device *rdev)
6753 {
6754         struct cfg80211_scan_request *req = rdev->scan_req;
6755         struct nlattr *nest;
6756         int i;
6757
6758         ASSERT_RDEV_LOCK(rdev);
6759
6760         if (WARN_ON(!req))
6761                 return 0;
6762
6763         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
6764         if (!nest)
6765                 goto nla_put_failure;
6766         for (i = 0; i < req->n_ssids; i++)
6767                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
6768         nla_nest_end(msg, nest);
6769
6770         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
6771         if (!nest)
6772                 goto nla_put_failure;
6773         for (i = 0; i < req->n_channels; i++)
6774                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
6775         nla_nest_end(msg, nest);
6776
6777         if (req->ie)
6778                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
6779
6780         return 0;
6781  nla_put_failure:
6782         return -ENOBUFS;
6783 }
6784
6785 static int nl80211_send_scan_msg(struct sk_buff *msg,
6786                                  struct cfg80211_registered_device *rdev,
6787                                  struct net_device *netdev,
6788                                  u32 pid, u32 seq, int flags,
6789                                  u32 cmd)
6790 {
6791         void *hdr;
6792
6793         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
6794         if (!hdr)
6795                 return -1;
6796
6797         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6798         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6799
6800         /* ignore errors and send incomplete event anyway */
6801         nl80211_add_scan_req(msg, rdev);
6802
6803         return genlmsg_end(msg, hdr);
6804
6805  nla_put_failure:
6806         genlmsg_cancel(msg, hdr);
6807         return -EMSGSIZE;
6808 }
6809
6810 static int
6811 nl80211_send_sched_scan_msg(struct sk_buff *msg,
6812                             struct cfg80211_registered_device *rdev,
6813                             struct net_device *netdev,
6814                             u32 pid, u32 seq, int flags, u32 cmd)
6815 {
6816         void *hdr;
6817
6818         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
6819         if (!hdr)
6820                 return -1;
6821
6822         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6823         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6824
6825         return genlmsg_end(msg, hdr);
6826
6827  nla_put_failure:
6828         genlmsg_cancel(msg, hdr);
6829         return -EMSGSIZE;
6830 }
6831
6832 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
6833                              struct net_device *netdev)
6834 {
6835         struct sk_buff *msg;
6836
6837         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6838         if (!msg)
6839                 return;
6840
6841         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
6842                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
6843                 nlmsg_free(msg);
6844                 return;
6845         }
6846
6847         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6848                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6849 }
6850
6851 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
6852                             struct net_device *netdev)
6853 {
6854         struct sk_buff *msg;
6855
6856         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6857         if (!msg)
6858                 return;
6859
6860         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
6861                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
6862                 nlmsg_free(msg);
6863                 return;
6864         }
6865
6866         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6867                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6868 }
6869
6870 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
6871                                struct net_device *netdev)
6872 {
6873         struct sk_buff *msg;
6874
6875         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6876         if (!msg)
6877                 return;
6878
6879         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
6880                                   NL80211_CMD_SCAN_ABORTED) < 0) {
6881                 nlmsg_free(msg);
6882                 return;
6883         }
6884
6885         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6886                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6887 }
6888
6889 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
6890                                      struct net_device *netdev)
6891 {
6892         struct sk_buff *msg;
6893
6894         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6895         if (!msg)
6896                 return;
6897
6898         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
6899                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
6900                 nlmsg_free(msg);
6901                 return;
6902         }
6903
6904         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6905                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6906 }
6907
6908 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
6909                              struct net_device *netdev, u32 cmd)
6910 {
6911         struct sk_buff *msg;
6912
6913         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6914         if (!msg)
6915                 return;
6916
6917         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
6918                 nlmsg_free(msg);
6919                 return;
6920         }
6921
6922         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6923                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6924 }
6925
6926 /*
6927  * This can happen on global regulatory changes or device specific settings
6928  * based on custom world regulatory domains.
6929  */
6930 void nl80211_send_reg_change_event(struct regulatory_request *request)
6931 {
6932         struct sk_buff *msg;
6933         void *hdr;
6934
6935         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6936         if (!msg)
6937                 return;
6938
6939         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
6940         if (!hdr) {
6941                 nlmsg_free(msg);
6942                 return;
6943         }
6944
6945         /* Userspace can always count this one always being set */
6946         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
6947
6948         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
6949                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6950                            NL80211_REGDOM_TYPE_WORLD);
6951         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
6952                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6953                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
6954         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
6955                  request->intersect)
6956                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6957                            NL80211_REGDOM_TYPE_INTERSECTION);
6958         else {
6959                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6960                            NL80211_REGDOM_TYPE_COUNTRY);
6961                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
6962         }
6963
6964         if (wiphy_idx_valid(request->wiphy_idx))
6965                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
6966
6967         genlmsg_end(msg, hdr);
6968
6969         rcu_read_lock();
6970         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
6971                                 GFP_ATOMIC);
6972         rcu_read_unlock();
6973
6974         return;
6975
6976 nla_put_failure:
6977         genlmsg_cancel(msg, hdr);
6978         nlmsg_free(msg);
6979 }
6980
6981 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
6982                                     struct net_device *netdev,
6983                                     const u8 *buf, size_t len,
6984                                     enum nl80211_commands cmd, gfp_t gfp)
6985 {
6986         struct sk_buff *msg;
6987         void *hdr;
6988
6989         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6990         if (!msg)
6991                 return;
6992
6993         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
6994         if (!hdr) {
6995                 nlmsg_free(msg);
6996                 return;
6997         }
6998
6999         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7000         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7001         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
7002
7003         genlmsg_end(msg, hdr);
7004
7005         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7006                                 nl80211_mlme_mcgrp.id, gfp);
7007         return;
7008
7009  nla_put_failure:
7010         genlmsg_cancel(msg, hdr);
7011         nlmsg_free(msg);
7012 }
7013
7014 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
7015                           struct net_device *netdev, const u8 *buf,
7016                           size_t len, gfp_t gfp)
7017 {
7018         nl80211_send_mlme_event(rdev, netdev, buf, len,
7019                                 NL80211_CMD_AUTHENTICATE, gfp);
7020 }
7021
7022 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
7023                            struct net_device *netdev, const u8 *buf,
7024                            size_t len, gfp_t gfp)
7025 {
7026         nl80211_send_mlme_event(rdev, netdev, buf, len,
7027                                 NL80211_CMD_ASSOCIATE, gfp);
7028 }
7029
7030 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
7031                          struct net_device *netdev, const u8 *buf,
7032                          size_t len, gfp_t gfp)
7033 {
7034         nl80211_send_mlme_event(rdev, netdev, buf, len,
7035                                 NL80211_CMD_DEAUTHENTICATE, gfp);
7036 }
7037
7038 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
7039                            struct net_device *netdev, const u8 *buf,
7040                            size_t len, gfp_t gfp)
7041 {
7042         nl80211_send_mlme_event(rdev, netdev, buf, len,
7043                                 NL80211_CMD_DISASSOCIATE, gfp);
7044 }
7045
7046 void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
7047                                 struct net_device *netdev, const u8 *buf,
7048                                 size_t len, gfp_t gfp)
7049 {
7050         nl80211_send_mlme_event(rdev, netdev, buf, len,
7051                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
7052 }
7053
7054 void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
7055                                   struct net_device *netdev, const u8 *buf,
7056                                   size_t len, gfp_t gfp)
7057 {
7058         nl80211_send_mlme_event(rdev, netdev, buf, len,
7059                                 NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
7060 }
7061
7062 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
7063                                       struct net_device *netdev, int cmd,
7064                                       const u8 *addr, gfp_t gfp)
7065 {
7066         struct sk_buff *msg;
7067         void *hdr;
7068
7069         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7070         if (!msg)
7071                 return;
7072
7073         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
7074         if (!hdr) {
7075                 nlmsg_free(msg);
7076                 return;
7077         }
7078
7079         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7080         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7081         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
7082         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
7083
7084         genlmsg_end(msg, hdr);
7085
7086         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7087                                 nl80211_mlme_mcgrp.id, gfp);
7088         return;
7089
7090  nla_put_failure:
7091         genlmsg_cancel(msg, hdr);
7092         nlmsg_free(msg);
7093 }
7094
7095 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
7096                                struct net_device *netdev, const u8 *addr,
7097                                gfp_t gfp)
7098 {
7099         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
7100                                   addr, gfp);
7101 }
7102
7103 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
7104                                 struct net_device *netdev, const u8 *addr,
7105                                 gfp_t gfp)
7106 {
7107         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
7108                                   addr, gfp);
7109 }
7110
7111 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
7112                                  struct net_device *netdev, const u8 *bssid,
7113                                  const u8 *req_ie, size_t req_ie_len,
7114                                  const u8 *resp_ie, size_t resp_ie_len,
7115                                  u16 status, gfp_t gfp)
7116 {
7117         struct sk_buff *msg;
7118         void *hdr;
7119
7120         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7121         if (!msg)
7122                 return;
7123
7124         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
7125         if (!hdr) {
7126                 nlmsg_free(msg);
7127                 return;
7128         }
7129
7130         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7131         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7132         if (bssid)
7133                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
7134         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
7135         if (req_ie)
7136                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
7137         if (resp_ie)
7138                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
7139
7140         genlmsg_end(msg, hdr);
7141
7142         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7143                                 nl80211_mlme_mcgrp.id, gfp);
7144         return;
7145
7146  nla_put_failure:
7147         genlmsg_cancel(msg, hdr);
7148         nlmsg_free(msg);
7149
7150 }
7151
7152 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
7153                          struct net_device *netdev, const u8 *bssid,
7154                          const u8 *req_ie, size_t req_ie_len,
7155                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
7156 {
7157         struct sk_buff *msg;
7158         void *hdr;
7159
7160         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7161         if (!msg)
7162                 return;
7163
7164         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
7165         if (!hdr) {
7166                 nlmsg_free(msg);
7167                 return;
7168         }
7169
7170         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7171         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7172         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
7173         if (req_ie)
7174                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
7175         if (resp_ie)
7176                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
7177
7178         genlmsg_end(msg, hdr);
7179
7180         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7181                                 nl80211_mlme_mcgrp.id, gfp);
7182         return;
7183
7184  nla_put_failure:
7185         genlmsg_cancel(msg, hdr);
7186         nlmsg_free(msg);
7187
7188 }
7189
7190 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
7191                                struct net_device *netdev, u16 reason,
7192                                const u8 *ie, size_t ie_len, bool from_ap)
7193 {
7194         struct sk_buff *msg;
7195         void *hdr;
7196
7197         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
7198         if (!msg)
7199                 return;
7200
7201         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
7202         if (!hdr) {
7203                 nlmsg_free(msg);
7204                 return;
7205         }
7206
7207         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7208         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7209         if (from_ap && reason)
7210                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
7211         if (from_ap)
7212                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
7213         if (ie)
7214                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
7215
7216         genlmsg_end(msg, hdr);
7217
7218         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7219                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
7220         return;
7221
7222  nla_put_failure:
7223         genlmsg_cancel(msg, hdr);
7224         nlmsg_free(msg);
7225
7226 }
7227
7228 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
7229                              struct net_device *netdev, const u8 *bssid,
7230                              gfp_t gfp)
7231 {
7232         struct sk_buff *msg;
7233         void *hdr;
7234
7235         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7236         if (!msg)
7237                 return;
7238
7239         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
7240         if (!hdr) {
7241                 nlmsg_free(msg);
7242                 return;
7243         }
7244
7245         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7246         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7247         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
7248
7249         genlmsg_end(msg, hdr);
7250
7251         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7252                                 nl80211_mlme_mcgrp.id, gfp);
7253         return;
7254
7255  nla_put_failure:
7256         genlmsg_cancel(msg, hdr);
7257         nlmsg_free(msg);
7258 }
7259
7260 void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
7261                 struct net_device *netdev,
7262                 const u8 *macaddr, const u8* ie, u8 ie_len,
7263                 gfp_t gfp)
7264 {
7265         struct sk_buff *msg;
7266         void *hdr;
7267
7268         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7269         if (!msg)
7270                 return;
7271
7272         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
7273         if (!hdr) {
7274                 nlmsg_free(msg);
7275                 return;
7276         }
7277
7278         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7279         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7280         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr);
7281         if (ie_len && ie)
7282                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len , ie);
7283
7284         genlmsg_end(msg, hdr);
7285
7286         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7287                                 nl80211_mlme_mcgrp.id, gfp);
7288         return;
7289
7290  nla_put_failure:
7291         genlmsg_cancel(msg, hdr);
7292         nlmsg_free(msg);
7293 }
7294
7295 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
7296                                  struct net_device *netdev, const u8 *addr,
7297                                  enum nl80211_key_type key_type, int key_id,
7298                                  const u8 *tsc, gfp_t gfp)
7299 {
7300         struct sk_buff *msg;
7301         void *hdr;
7302
7303         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7304         if (!msg)
7305                 return;
7306
7307         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
7308         if (!hdr) {
7309                 nlmsg_free(msg);
7310                 return;
7311         }
7312
7313         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7314         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7315         if (addr)
7316                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
7317         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
7318         if (key_id != -1)
7319                 NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
7320         if (tsc)
7321                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
7322
7323         genlmsg_end(msg, hdr);
7324
7325         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7326                                 nl80211_mlme_mcgrp.id, gfp);
7327         return;
7328
7329  nla_put_failure:
7330         genlmsg_cancel(msg, hdr);
7331         nlmsg_free(msg);
7332 }
7333
7334 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
7335                                     struct ieee80211_channel *channel_before,
7336                                     struct ieee80211_channel *channel_after)
7337 {
7338         struct sk_buff *msg;
7339         void *hdr;
7340         struct nlattr *nl_freq;
7341
7342         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
7343         if (!msg)
7344                 return;
7345
7346         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
7347         if (!hdr) {
7348                 nlmsg_free(msg);
7349                 return;
7350         }
7351
7352         /*
7353          * Since we are applying the beacon hint to a wiphy we know its
7354          * wiphy_idx is valid
7355          */
7356         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
7357
7358         /* Before */
7359         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
7360         if (!nl_freq)
7361                 goto nla_put_failure;
7362         if (nl80211_msg_put_channel(msg, channel_before))
7363                 goto nla_put_failure;
7364         nla_nest_end(msg, nl_freq);
7365
7366         /* After */
7367         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
7368         if (!nl_freq)
7369                 goto nla_put_failure;
7370         if (nl80211_msg_put_channel(msg, channel_after))
7371                 goto nla_put_failure;
7372         nla_nest_end(msg, nl_freq);
7373
7374         genlmsg_end(msg, hdr);
7375
7376         rcu_read_lock();
7377         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
7378                                 GFP_ATOMIC);
7379         rcu_read_unlock();
7380
7381         return;
7382
7383 nla_put_failure:
7384         genlmsg_cancel(msg, hdr);
7385         nlmsg_free(msg);
7386 }
7387
7388 static void nl80211_send_remain_on_chan_event(
7389         int cmd, struct cfg80211_registered_device *rdev,
7390         struct net_device *netdev, u64 cookie,
7391         struct ieee80211_channel *chan,
7392         enum nl80211_channel_type channel_type,
7393         unsigned int duration, gfp_t gfp)
7394 {
7395         struct sk_buff *msg;
7396         void *hdr;
7397
7398         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7399         if (!msg)
7400                 return;
7401
7402         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
7403         if (!hdr) {
7404                 nlmsg_free(msg);
7405                 return;
7406         }
7407
7408         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7409         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7410         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
7411         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
7412         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
7413
7414         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
7415                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
7416
7417         genlmsg_end(msg, hdr);
7418
7419         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7420                                 nl80211_mlme_mcgrp.id, gfp);
7421         return;
7422
7423  nla_put_failure:
7424         genlmsg_cancel(msg, hdr);
7425         nlmsg_free(msg);
7426 }
7427
7428 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
7429                                     struct net_device *netdev, u64 cookie,
7430                                     struct ieee80211_channel *chan,
7431                                     enum nl80211_channel_type channel_type,
7432                                     unsigned int duration, gfp_t gfp)
7433 {
7434         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
7435                                           rdev, netdev, cookie, chan,
7436                                           channel_type, duration, gfp);
7437 }
7438
7439 void nl80211_send_remain_on_channel_cancel(
7440         struct cfg80211_registered_device *rdev, struct net_device *netdev,
7441         u64 cookie, struct ieee80211_channel *chan,
7442         enum nl80211_channel_type channel_type, gfp_t gfp)
7443 {
7444         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
7445                                           rdev, netdev, cookie, chan,
7446                                           channel_type, 0, gfp);
7447 }
7448
7449 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
7450                             struct net_device *dev, const u8 *mac_addr,
7451                             struct station_info *sinfo, gfp_t gfp)
7452 {
7453         struct sk_buff *msg;
7454
7455         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7456         if (!msg)
7457                 return;
7458
7459         if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
7460                 nlmsg_free(msg);
7461                 return;
7462         }
7463
7464         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7465                                 nl80211_mlme_mcgrp.id, gfp);
7466 }
7467
7468 void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
7469                                 struct net_device *dev, const u8 *mac_addr,
7470                                 gfp_t gfp)
7471 {
7472         struct sk_buff *msg;
7473         void *hdr;
7474
7475         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7476         if (!msg)
7477                 return;
7478
7479         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
7480         if (!hdr) {
7481                 nlmsg_free(msg);
7482                 return;
7483         }
7484
7485         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
7486         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
7487
7488         genlmsg_end(msg, hdr);
7489
7490         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7491                                 nl80211_mlme_mcgrp.id, gfp);
7492         return;
7493
7494  nla_put_failure:
7495         genlmsg_cancel(msg, hdr);
7496         nlmsg_free(msg);
7497 }
7498
7499 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
7500                                        const u8 *addr, gfp_t gfp)
7501 {
7502         struct wireless_dev *wdev = dev->ieee80211_ptr;
7503         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
7504         struct sk_buff *msg;
7505         void *hdr;
7506         int err;
7507         u32 nlpid = ACCESS_ONCE(wdev->ap_unexpected_nlpid);
7508
7509         if (!nlpid)
7510                 return false;
7511
7512         msg = nlmsg_new(100, gfp);
7513         if (!msg)
7514                 return true;
7515
7516         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
7517         if (!hdr) {
7518                 nlmsg_free(msg);
7519                 return true;
7520         }
7521
7522         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7523         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
7524         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
7525
7526         err = genlmsg_end(msg, hdr);
7527         if (err < 0) {
7528                 nlmsg_free(msg);
7529                 return true;
7530         }
7531
7532         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
7533         return true;
7534
7535  nla_put_failure:
7536         genlmsg_cancel(msg, hdr);
7537         nlmsg_free(msg);
7538         return true;
7539 }
7540
7541 bool nl80211_unexpected_frame(struct net_device *dev, const u8 *addr, gfp_t gfp)
7542 {
7543         return __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
7544                                           addr, gfp);
7545 }
7546
7547 bool nl80211_unexpected_4addr_frame(struct net_device *dev,
7548                                     const u8 *addr, gfp_t gfp)
7549 {
7550         return __nl80211_unexpected_frame(dev,
7551                                           NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
7552                                           addr, gfp);
7553 }
7554
7555 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
7556                       struct net_device *netdev, u32 nlpid,
7557                       int freq, const u8 *buf, size_t len, gfp_t gfp)
7558 {
7559         struct sk_buff *msg;
7560         void *hdr;
7561
7562         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7563         if (!msg)
7564                 return -ENOMEM;
7565
7566         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
7567         if (!hdr) {
7568                 nlmsg_free(msg);
7569                 return -ENOMEM;
7570         }
7571
7572         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7573         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7574         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
7575         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
7576
7577         genlmsg_end(msg, hdr);
7578
7579         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
7580
7581  nla_put_failure:
7582         genlmsg_cancel(msg, hdr);
7583         nlmsg_free(msg);
7584         return -ENOBUFS;
7585 }
7586
7587 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
7588                                  struct net_device *netdev, u64 cookie,
7589                                  const u8 *buf, size_t len, bool ack,
7590                                  gfp_t gfp)
7591 {
7592         struct sk_buff *msg;
7593         void *hdr;
7594
7595         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7596         if (!msg)
7597                 return;
7598
7599         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
7600         if (!hdr) {
7601                 nlmsg_free(msg);
7602                 return;
7603         }
7604
7605         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7606         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7607         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
7608         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
7609         if (ack)
7610                 NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
7611
7612         genlmsg_end(msg, hdr);
7613
7614         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
7615         return;
7616
7617  nla_put_failure:
7618         genlmsg_cancel(msg, hdr);
7619         nlmsg_free(msg);
7620 }
7621
7622 void
7623 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
7624                              struct net_device *netdev,
7625                              enum nl80211_cqm_rssi_threshold_event rssi_event,
7626                              gfp_t gfp)
7627 {
7628         struct sk_buff *msg;
7629         struct nlattr *pinfoattr;
7630         void *hdr;
7631
7632         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7633         if (!msg)
7634                 return;
7635
7636         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
7637         if (!hdr) {
7638                 nlmsg_free(msg);
7639                 return;
7640         }
7641
7642         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7643         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7644
7645         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
7646         if (!pinfoattr)
7647                 goto nla_put_failure;
7648
7649         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
7650                     rssi_event);
7651
7652         nla_nest_end(msg, pinfoattr);
7653
7654         genlmsg_end(msg, hdr);
7655
7656         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7657                                 nl80211_mlme_mcgrp.id, gfp);
7658         return;
7659
7660  nla_put_failure:
7661         genlmsg_cancel(msg, hdr);
7662         nlmsg_free(msg);
7663 }
7664
7665 void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
7666                               struct net_device *netdev, const u8 *bssid,
7667                               const u8 *replay_ctr, gfp_t gfp)
7668 {
7669         struct sk_buff *msg;
7670         struct nlattr *rekey_attr;
7671         void *hdr;
7672
7673         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7674         if (!msg)
7675                 return;
7676
7677         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
7678         if (!hdr) {
7679                 nlmsg_free(msg);
7680                 return;
7681         }
7682
7683         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7684         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7685         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
7686
7687         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
7688         if (!rekey_attr)
7689                 goto nla_put_failure;
7690
7691         NLA_PUT(msg, NL80211_REKEY_DATA_REPLAY_CTR,
7692                 NL80211_REPLAY_CTR_LEN, replay_ctr);
7693
7694         nla_nest_end(msg, rekey_attr);
7695
7696         genlmsg_end(msg, hdr);
7697
7698         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7699                                 nl80211_mlme_mcgrp.id, gfp);
7700         return;
7701
7702  nla_put_failure:
7703         genlmsg_cancel(msg, hdr);
7704         nlmsg_free(msg);
7705 }
7706
7707 void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
7708                                     struct net_device *netdev, int index,
7709                                     const u8 *bssid, bool preauth, gfp_t gfp)
7710 {
7711         struct sk_buff *msg;
7712         struct nlattr *attr;
7713         void *hdr;
7714
7715         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7716         if (!msg)
7717                 return;
7718
7719         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
7720         if (!hdr) {
7721                 nlmsg_free(msg);
7722                 return;
7723         }
7724
7725         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7726         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7727
7728         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
7729         if (!attr)
7730                 goto nla_put_failure;
7731
7732         NLA_PUT_U32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index);
7733         NLA_PUT(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid);
7734         if (preauth)
7735                 NLA_PUT_FLAG(msg, NL80211_PMKSA_CANDIDATE_PREAUTH);
7736
7737         nla_nest_end(msg, attr);
7738
7739         genlmsg_end(msg, hdr);
7740
7741         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7742                                 nl80211_mlme_mcgrp.id, gfp);
7743         return;
7744
7745  nla_put_failure:
7746         genlmsg_cancel(msg, hdr);
7747         nlmsg_free(msg);
7748 }
7749
7750 void
7751 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
7752                                 struct net_device *netdev, const u8 *peer,
7753                                 u32 num_packets, gfp_t gfp)
7754 {
7755         struct sk_buff *msg;
7756         struct nlattr *pinfoattr;
7757         void *hdr;
7758
7759         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7760         if (!msg)
7761                 return;
7762
7763         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
7764         if (!hdr) {
7765                 nlmsg_free(msg);
7766                 return;
7767         }
7768
7769         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7770         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7771         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, peer);
7772
7773         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
7774         if (!pinfoattr)
7775                 goto nla_put_failure;
7776
7777         NLA_PUT_U32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets);
7778
7779         nla_nest_end(msg, pinfoattr);
7780
7781         genlmsg_end(msg, hdr);
7782
7783         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7784                                 nl80211_mlme_mcgrp.id, gfp);
7785         return;
7786
7787  nla_put_failure:
7788         genlmsg_cancel(msg, hdr);
7789         nlmsg_free(msg);
7790 }
7791
7792 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
7793                            u64 cookie, bool acked, gfp_t gfp)
7794 {
7795         struct wireless_dev *wdev = dev->ieee80211_ptr;
7796         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
7797         struct sk_buff *msg;
7798         void *hdr;
7799         int err;
7800
7801         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7802         if (!msg)
7803                 return;
7804
7805         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
7806         if (!hdr) {
7807                 nlmsg_free(msg);
7808                 return;
7809         }
7810
7811         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7812         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
7813         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
7814         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
7815         if (acked)
7816                 NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
7817
7818         err = genlmsg_end(msg, hdr);
7819         if (err < 0) {
7820                 nlmsg_free(msg);
7821                 return;
7822         }
7823
7824         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7825                                 nl80211_mlme_mcgrp.id, gfp);
7826         return;
7827
7828  nla_put_failure:
7829         genlmsg_cancel(msg, hdr);
7830         nlmsg_free(msg);
7831 }
7832 EXPORT_SYMBOL(cfg80211_probe_status);
7833
7834 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
7835                                  const u8 *frame, size_t len,
7836                                  int freq, gfp_t gfp)
7837 {
7838         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
7839         struct sk_buff *msg;
7840         void *hdr;
7841         u32 nlpid = ACCESS_ONCE(rdev->ap_beacons_nlpid);
7842
7843         if (!nlpid)
7844                 return;
7845
7846         msg = nlmsg_new(len + 100, gfp);
7847         if (!msg)
7848                 return;
7849
7850         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
7851         if (!hdr) {
7852                 nlmsg_free(msg);
7853                 return;
7854         }
7855
7856         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7857         if (freq)
7858                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
7859         NLA_PUT(msg, NL80211_ATTR_FRAME, len, frame);
7860
7861         genlmsg_end(msg, hdr);
7862
7863         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
7864         return;
7865
7866  nla_put_failure:
7867         genlmsg_cancel(msg, hdr);
7868         nlmsg_free(msg);
7869 }
7870 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
7871
7872 static int nl80211_netlink_notify(struct notifier_block * nb,
7873                                   unsigned long state,
7874                                   void *_notify)
7875 {
7876         struct netlink_notify *notify = _notify;
7877         struct cfg80211_registered_device *rdev;
7878         struct wireless_dev *wdev;
7879
7880         if (state != NETLINK_URELEASE)
7881                 return NOTIFY_DONE;
7882
7883         rcu_read_lock();
7884
7885         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
7886                 list_for_each_entry_rcu(wdev, &rdev->netdev_list, list)
7887                         cfg80211_mlme_unregister_socket(wdev, notify->pid);
7888                 if (rdev->ap_beacons_nlpid == notify->pid)
7889                         rdev->ap_beacons_nlpid = 0;
7890         }
7891
7892         rcu_read_unlock();
7893
7894         return NOTIFY_DONE;
7895 }
7896
7897 static struct notifier_block nl80211_netlink_notifier = {
7898         .notifier_call = nl80211_netlink_notify,
7899 };
7900
7901 /* initialisation/exit functions */
7902
7903 int nl80211_init(void)
7904 {
7905         int err;
7906
7907         err = genl_register_family_with_ops(&nl80211_fam,
7908                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
7909         if (err)
7910                 return err;
7911
7912         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
7913         if (err)
7914                 goto err_out;
7915
7916         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
7917         if (err)
7918                 goto err_out;
7919
7920         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
7921         if (err)
7922                 goto err_out;
7923
7924         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
7925         if (err)
7926                 goto err_out;
7927
7928 #ifdef CONFIG_NL80211_TESTMODE
7929         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
7930         if (err)
7931                 goto err_out;
7932 #endif
7933
7934         err = netlink_register_notifier(&nl80211_netlink_notifier);
7935         if (err)
7936                 goto err_out;
7937
7938         return 0;
7939  err_out:
7940         genl_unregister_family(&nl80211_fam);
7941         return err;
7942 }
7943
7944 void nl80211_exit(void)
7945 {
7946         netlink_unregister_notifier(&nl80211_netlink_notifier);
7947         genl_unregister_family(&nl80211_fam);
7948 }